Idea: lint initialising structs with non-`pub` fields outside of their initialisers

What it does

Private fields on structs are very likely those that have safety invariants associated with them that can't be expressed through the type system directly; Initialising structs with such fields directly in a different module/crate is a compilation error, however, forgetting to account for the safety invariants when initialising the struct in the same module won't be prevented in any way by the compiler. This lint aims to prevent accidental invalid initialisation of structs by forcing to confine their validation to methods with the following names:

• new
• new_unchecked
• from_*

Advantage

• The fewer times validation code is repeated, the lesser is the chance of it being written incorrectly in some of the places.
• Having all validation of safety invariants confined to one or a few functions bundled together makes it easier to change the safety invariants without introducing any bugs.

Drawbacks

No response

Example

/// A note from C2 to B4
// Invariant: self.0 <= Self::MAX.0
#[derive(Clone, Copy)]
pub struct Note(u8);

impl Note {
    const MAX: Note = Note(35);
  
    pub const unsafe fn new_unchecked(index: u8) -> Self {
        Self(index)
    }
    
    pub fn new(index: u8) -> Option<Self> {
        (index <= Self::MAX.0).then_some(Self(index))
    }
}

impl Add<u8> for Note {
    type Output = Option<Self>;
    
    fn add(self, rhs: u8) -> Self::Output {
        // warning: initialising `Note` outside of a constructor is error-prone
        self.0.checked_add(rhs).map(Self) // woopsie! UB
    }
}

Could be written as:

/// A note from C2 to B4
// Invariant: self.0 <= Self::MAX.0
#[derive(Clone, Copy)]
pub struct Note(u8);

impl Note {
    const MAX: Note = unsafe { Note::new_unchecked(35) };
  
    pub const unsafe fn new_unchecked(index: u8) -> Self {
        Self(index)
    }
    
    pub fn new(index: u8) -> Option<Self> {
        (index <= Self::MAX.0).then_some(Self(index))
    }
}

impl Add<u8> for Note {
    type Output = Option<Self>;
    
    fn add(self, rhs: u8) -> Self::Output {
        self.0.checked_add(rhs).and_then(Self::new)
    }
}

Start with the proposed behavior and Rust examples in the issue, then review Clippy's existing lint conventions and test structure. Done means the lint identifies direct initialization of structs with non-public fields outside the named constructor patterns and documents or tests the intended exceptions.