ci: Check the API visibility

Add a lint stage which will check we don't accidentally add private headers to public ones, and that all public headers are included in the public handy.h.