Lint: Prevent private API imports in all bundled packages

[ntsekouras]

What?

Follow up of: #81478 (comment)

This PR extends the restriction from #81478 to every bundled package (packages with neither wpScript nor wpScriptModuleExports), so private API usage can't creep into any package that plugins may bundle via npm. Besides the direct @wordpress/private-apis imports, the rule also restricts the relative lock-unlock imports, so new usages inside packages that already use private APIs are blocked too.

The existing usages (43 across 8 packages) are suppressed in tools/eslint/suppressions.json, so they can only go down. ui and e2e-test-utils-playwright are excluded from the shared override because they have their own no-restricted-imports overrides, ui gets the same restriction through UI_RESTRICTED_IMPORTS.

Testing Instructions

1. Add import { unlock } from './lock-unlock'; to a file in packages/fields/src that doesn't already import it and run npm run lint:js -- <the file>. It should error.
2. Do the same in a file in packages/ui/src with import { __dangerousOptInToUnstableAPIsOnlyForCoreModules } from '@wordpress/private-apis';. It should error.
3. Without changes, npm run lint:js should be 🟢.

Use of AI Tools

Generated with Fable 5 and adjusted/reviewed manually.

[github-actions]

Size Change: 0 B

Total Size: 7.91 MB

_{compressed-size-action}

[github-actions]

Flaky tests detected in d894939.
Some tests passed with failed attempts. The failures may not be related to this commit but are still reported for visibility. See the documentation for more information.

🔍 Workflow run URL: https://github.com/WordPress/gutenberg/actions/runs/32950427518
📝 Reported tests:

remembers sidebar dismissal between sessions in /test/e2e/specs/editor/various/preferences.spec.js, passed after 1 failed attempt.

Error: apiRequestContext.fetch: socket hang up
Call log:
  - → PUT http://localhost:8889/wp-json/wp/v2/users/me
    - user-agent: Playwright/1.62.1 (x64; ubuntu 24.04) node/20.20 CI/1
    - accept: */*
    - accept-encoding: gzip,deflate,br
    - X-WP-Nonce: c777759243
    - content-type: application/json
    - content-length: 37
    - cookie: wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_23778236db82f19306f247e20a353a99=admin%7C1787907848%7CICRa4txrzo57n75gc5PnEYPXjEs2ACu12nWHhkqKiAb%7C16470e073f65cec02dd8a723c14a5272bcf3e250c2bf47c358ced27bbb71e922; wp-settings-time-1=1787735271

    at RequestUtils.rest (/home/runner/work/gutenberg/gutenberg/packages/e2e-test-utils-playwright/src/request-utils/rest.ts:112:39)
    at RequestUtils.resetPreferences (/home/runner/work/gutenberg/gutenberg/packages/e2e-test-utils-playwright/src/request-utils/preferences.ts:9:13)
    at /home/runner/work/gutenberg/gutenberg/test/e2e/specs/editor/various/preferences.spec.js:11:22

[aduth]

Thanks for following-up on this 👍

[aduth]

We existing issues here are concerning 🙈 We might want to track them somehow, or at least the ones that are likely to cause issues.

[ntsekouras]

I opened an issue: #82056.

[github-actions]

The following accounts have interacted with this PR and/or linked issues. I will continue to update these lists as activity occurs. You can also manually ask me to refresh this list by adding the props-bot label.

If you're merging code through a pull request on GitHub, copy and paste the following into the bottom of the merge commit message.

Co-authored-by: ntsekouras <ntsekouras@git.wordpress.org>
Co-authored-by: aduth <aduth@git.wordpress.org>
Co-authored-by: ciampo <mciampini@git.wordpress.org>

To understand the WordPress project's expectations around crediting contributors, please review the Contributor Attribution page in the Core Handbook.

[ciampo]

LGTM, apart from a minor comment 🚀

Good to merge once feedback is addressed. Thank you!