Track the public API surface in CI #1580

What happens

The public API is whatever packages/testcontainers/src/index.ts exports, plus every type reachable from those exports. Nothing shows a reviewer when a pull request changes it.

• Types used in public signatures went unexported.
• The TestContainer interface fell behind GenericContainer.
• Whether a change is breaking is judged by hand, and the semver label is applied by hand.

Expected

A generated API report checked in CI, for example with API Extractor:

• The report is committed. A pull request that changes the public API changes the report, and the diff is visible in review.
• An exported signature that references an unexported type fails the check.
• A removed or changed export requires the major label.

Where

• .github/workflows/checks.yml
• root package.json scripts, next to knip
• packages/testcontainers, and optionally each module

Notes

• npm run knip covers unused exports. This covers the opposite problem.
• A committed report is touched by every API change, so it conflicts when many API pull requests are open at once. Regenerating on rebase resolves it.

Dependencies

• Blocked by Export the types used in public method signatures #1528: the unexported-type check fails until those types are exported.
• Coordinate with Add the missing builder methods to the TestContainer interface #1529: the first report should be taken after the interface is complete.