Audit and tighten Bazel target visibility to expose only the public API

`score_baselibs` currently marks a large number of Bazel targets as `visibility = ["//visibility:public"]` without a consistent policy for when this is appropriate.

### Goal
Go through `/score` package by package and:
- Identify which targets constitute the actual public API of score_baselibs and should keep `//visibility:public`.
- Restrict all other targets (internal helpers, private mocks, test-only libraries, implementation details) to the narrowest visibility that satisfies internal consumers.
- Where a target is unclear (used both internally and plausibly needed by external consumers), flag it for discussion.

Review Bazel targets package by package under /score, starting with public visibility declarations and their internal consumers. Record which targets form the public API, then narrow non-public targets to the smallest working scope and flag ambiguous externally useful targets for discussion. Done means every target has a justified visibility.

Written by the indexing model from the issue text.