test: extend public api contract

[rlippmann]

What changed

• tightened the portable core API contract with explicit export kind metadata, forbidden package-root exports, and minimal deterministic shape probes for selected stable helpers
• extended the API contract verifier to fail loudly on export-kind drift, forbidden export drift, exact all drift, exact engine public-member drift, and callable signature drift
• refined the contract so every intended package-root public import is classified intentionally, including type_alias entries for typing-style runtime exports, while keeping deeper engine/controller behavior coverage in the existing behavioral fixture suites

Why

• make Python-to-TypeScript API contract syncing more exact and auditable
• catch accidental public-surface drift earlier and with clearer contract failures
• align the core API harness more closely with the directive-drafter contract style without pulling deeper behavior checks into the API fixture layer

Checklist

• pre-commit run (uv run pre-commit run --all-files)
• tests pass (uv run pytest)