1.0 API: Public surface audit + explicit `__all__` exports

[RyanTheRobothead]

Walk every public package: identify what's part of the supported public API vs. internal. Add __all__ to every module that's importable. Move internal helpers under _internal submodules where it doesn't break current callers, or mark with leading underscore.

Output: a docs/reference/public_api.md listing the committed surface.

---

Roadmap metadata

• Phase: 1.0-rc — Hardening
• Project: 1.0 Public API Surface
• Blocked by: Client parity: add missing async methods across all service clients #285, Chore: Standardize ULID usage and type validation #164, Chore: Timezone aware Date-times throughout system #238, Feature: Paginate All REST Server Query Endpoints with Default Limits #245, Refactor: Manager Clients #127
• Blocks: 1.0 API: Semver + deprecation policy commitment #332, 1.0 API: Standard deprecation helpers + lint enforcement #333, 1.0 API: 0.x → 1.0 migration guide + helper script #334, Docs: Auto-generated API reference from Pydantic models #337, 1.0 API: AbstractEventHandler plugin contract as public-API commitment #339, 1.0 API: AbstractScheduler plugin contract as public-API commitment #341

Roadmap note: Identify AbstractEventHandler + EventHandlerSettings AND AbstractScheduler + WorkflowSchedulerMetadata as part of the committed public API surface. Two parallel plugin contracts (event handlers, schedulers) get pinned by their respective contract drafts.

Generated as part of the MADSci → 1.0 roadmap. See docs/roadmap.md for context.