[State Sync Redesign 2.2] Migrate `_onStateUpdate` to direct messenger subscriptions

`_onStateUpdate` reads `isUnlocked` and calls `_notifyChainChange`. Replace with focused subscriptions.

## Steps

1. Subscribe to `KeyringController:stateChange` for `isUnlocked`
2. Subscribe to `NetworkController:stateChange` for `_notifyChainChange`
3. Remove `this.on('update', _onStateUpdate)` listener

## Files

- `app/scripts/metamask-controller.js`

## Risk

Low — two focused subscriptions.

## Dependencies

None (can proceed immediately)

## Context

Part of [State Sync Redesign — Epic 2: Background cleanup].

Start in app/scripts/metamask-controller.js at _onStateUpdate and inspect nearby messenger subscription patterns. Replace the update listener with the two focused state-change subscriptions described in the issue, then verify the old listener is removed and each subscription handles only its specified responsibility.

Written by the indexing model from the issue text.