[`MetamaskController` A.9] Add ESLint `import/no-restricted-paths` boundary rule for `wallet-services/`

**Sub-epic:** https://github.com/MetaMask/metamask-extension/issues/41736
**File:** `.eslintrc.js`
**Size:** S

## Problem

Nothing mechanically prevents `wallet-services/` modules from importing `chrome.*`, `browser.*`, `webextension-polyfill`, or sibling extension-specific modules. The boundary currently exists only in `app/scripts/lib/wallet-services/README.md`. Without CI enforcement, regressions are invisible until package extraction.

## Solution

Add `import/no-restricted-paths` zones config targeting `./app/scripts/lib/wallet-services`. Forbidden sources: sibling `lib/*.ts|js`, sibling extension-specific dirs, and `webextension-polyfill`.

## Acceptance criteria

- [ ] Rule present in `.eslintrc.js`
- [ ] `yarn lint` green on current branch
- [ ] Deliberate violation (test import of `webextension-polyfill` inside a `wallet-services/` file) fails lint

## Dependencies

None. Can land any time — does not block other tickets and does not depend on them.

Start with the boundary description in app/scripts/lib/wallet-services/README.md, then inspect the ESLint configuration in .eslintrc.js and the existing import/no-restricted-paths zones. Add the wallet-services/ zones and verify the stated forbidden imports are covered. Run yarn lint and confirm a deliberate webextension-polyfill import inside wallet-services/ fails lint.

Written by the indexing model from the issue text.