[FEATURE] Public-interface enforcement (import only via __init__/__all__)

[LukasNiessen]

In short

A package should be used through its front door (its __init__/__all__), not by reaching into its internal files. This fails when someone writes from mypkg.internal.thing import X instead of from mypkg import X, so you can refactor internals freely.

Problem

Packages should expose a deliberate public surface; deep imports into a package's internals silently break encapsulation and make refactoring risky.

Proposal

A rule that a package may be imported only via its declared public interface (its __init__ / __all__), not its submodules' internals, e.g. project_files("src/").in_folder("**/mypkg/**").should().only_be_imported_via_public_interface(); deep cross-package imports fail.

Acceptance criteria

• A deep import like from mypkg.internal.thing import X from outside mypkg fails; from mypkg import X (the public interface) passes.
• The public surface is read from __all__ / __init__ and is configurable.