refactor: stop identify_feature_group being a re-export facade

[TKaltofen]

Follow-up to #891, which split identify_feature_group.py into resolution_types.py <- resolution_failure_renderer.py <- the matcher. That PR deliberately kept every pre-split import working via an __all__ re-export block, so no call site had to move. This removes that block. Behavior-preserving.

Why remove it rather than tidy it

The block was a compatibility layer for an API that no release exposes. At tag 0.10.0, still the latest release, mloda/core/prepare/identify_feature_group.py contained four top-level names (split_frameworks_by_capability, since deleted; matches_feature_group_scope; _scope_callout, private; IdentifyFeatureGroupClass) and declared no __all__ at all. Neither sibling module existed. So 13 of the 15 names it re-exported have never shipped, and mloda.core.* is internal regardless: the public facades are mloda.user, mloda.provider and mloda.steward, which import only FeatureResolutionError, ResolutionDiagnosis and ResolutionRecord.

Removing __all__ also restores the released behavior rather than changing it: 0.10.0 had none.

Changes

• __all__ deleted outright rather than trimmed. Under mypy --strict (--no-implicit-reexport) a module always exports what it defines, so __all__ there only ever re-exported names it merely imports. With it gone, an import kept for a downstream consumer is just an unused import and ruff F401 rejects it, which is what keeps the facade from returning one name at a time. That is now noted in the import block.
• All 26 call sites import each name from its owner: resolution_types for the result dataclasses and PARTIAL_RECORDS_CAP, resolution_failure_renderer for the rendering names, the matcher for FeatureResolutionError, ComputeFrameworkPinError, IdentifyFeatureGroupClass, matches_feature_group_scope, evaluate_and_render, resolve_or_raise. The three facades keep their own __all__ unchanged; only the source of two names moves.
• ResolutionDiagnosis also leaves the matcher's imports: it was imported solely to feed __all__ and the module body never used it.
• The pin test replaces three hand-maintained name tuples with one static sweep that fails any import of a borrowed name from the matcher, anywhere in mloda/, mloda_plugins/, tests/ and docs/. mypy is the primary enforcement and catches every static evasion; the sweep covers the case mypy goes quiet on, someone re-adding __all__ and routing call sites back through it.
• Renamed test_identify_feature_group_failure_renderer.py to test_resolution_failure_renderer.py and corrected two docstrings that placed _render_multiple and PARTIAL_RECORDS_CAP in the matcher. docs/docs/in_depth/mloda-api.md no longer advertises EvaluationResult as importable from the matcher.

Verification

tox green: 7535 passed, 170 skipped, ruff, license allowlist, mypy --strict over 901 files, bandit. Test count is net -1 because the pin file went from 9 tests to 8; no skip-count change.

Two independent deep reviews ran against the full diff. Findings worth recording:

• The sweep was silently vacuous under tox -e installed. It derived the repo root from the imported module, which under an sdist install resolves to site-packages, where there is no tests tree; the is_dir() guard then skipped everything and the test still passed. Reproduced (138 files swept, zero tests) and fixed by deriving the root from the test file, which is in the checkout under any import mode.
• docs/ holds marimo notebooks excluded from both mypy and F401, the one surface no gate covered. Added to the sweep.
• One review suggested keeping a restricted __all__ so import * stays tidy. Not taken: exactly one of 127 modules under mloda/core declares __all__ and it is an __init__.py, the two sibling modules from this same split declare none, and there are no star imports of any mloda.core module in the repo. It would reintroduce the hand-maintained list this PR removes.