4.0: tighten Container's public surface #565

This was generated by AI during a pre-4.0 audit of main at 9cd88e7.

Observation

• Container exposes providers_registry, cache_registry, context_registry, overrides_registry and a writable closed as public attributes (container.py:43-53). Outside code can swap or mutate them.
• overrides_registry is always providers_registry.overrides (container.py:91-102): two names for one object.
• Bug: Container(scope=Scope.REQUEST, parent_container=root, groups=[G]) registers G into the tree-wide registry, bypassing the ChildContainerRegistrationError guard that add_providers enforces (container.py:103-107, :205). Reproduced.
• resolve checks closed after the registry lookup, resolve_provider before it (container.py:143 vs :166): a closed container asked for an unregistered type raises ProviderNotRegisteredError, not ContainerClosedError. :147 uses _providers[...] while :150 uses find_provider.
• There is no public provider lookup: modern-di-grpc modern_di_grpc/main.py:45 calls container.providers_registry.find_provider.
• build_child_container, find_container, close_* and reset_override have no contract docstrings (AGENTS.md asks for them).

Proposal

• Add public Container.find_provider(type) -> AbstractProvider | None (name to confirm).
• Make the registries private; one name for the overrides registry.
• closed becomes a read-only property.
• Raise ChildContainerRegistrationError when groups is passed with parent_container (failing test first).
• Check closed first in both resolve and resolve_provider (failing test first).
• Contract docstrings for the listed methods.

Acceptance

Tests for each bullet; docs/providers/scopes.md and advanced-api.md no longer document registry attributes; migration guide entries. Follow-up for modern-di-grpc is tracked in the integrations issue.