I don't have any way of measuring whether or not the quadrature encoder is linear relative to the joystick's physical position, but by removing the joystick and manually sending quadrature pulses to the controller, then polling via command 0x01, I was able to confirm that the relationship between quadrature pulses and reported joystick position IS linear.  A single pulse increments/decrements the position by a value of 4.  The position is reported as a signed (two's complement) 8-bit integer.  The OEM controller is capable of reporting values ranging from 0x80-0x7F, but the actual joystick does not cover the entire range.  In my testing, the joystick appears to report approximately +/- 18 steps (shown above in the logic analyzer screenshots), for a range of 0xD0-0x48, but that may vary from one joystick to the next, depending on wear.