Decouple client contracts and close private role registries

tests/tooling/test_verify.py

@@ -25,6 +25,22 @@ CORPUS_LOADER.exec_module(CORPUS)
 
 
 class VerificationTests(unittest.TestCase):
+    def test_client_implementation_dependency_boundary_is_enforced(self) -> None:
+        metadata = VERIFY.workspace_metadata()
+        client = next(
+            package for package in metadata["packages"] if package["name"] == "lazaret-client"
+        )
+        client["dependencies"].append(
+            {
+                "name": "lazaret-host-coordinator",
+                "source": None,
+                "path": str(ROOT / "crates" / "lazaret-host-coordinator"),
+                "req": "=0.0.0",
+            }
+        )
+        with self.assertRaisesRegex(VERIFY.VerificationError, "Client depends"):
+            VERIFY.audit_dependencies(metadata)
+
     def test_verification_temporaries_use_the_ignored_target_tree(self) -> None:
         original = VERIFY.VERIFICATION_TEMP_ROOT
         try: