Unlocking State-Tracking in Linear RNNs Through Negative Eigenvalues