metropolis: Lock down visibility rules

This formalizes the package structure introduced by D683.

Test Plan: Pure refactor, CI only.

X-Origin-Diff: phab/D684
GitOrigin-RevId: 574aa14c71faf94f4a5c02a2110e2e3fef7d36ac
diff --git a/metropolis/test/nanoswitch/BUILD b/metropolis/test/nanoswitch/BUILD
index fa7e271..643d16b 100644
--- a/metropolis/test/nanoswitch/BUILD
+++ b/metropolis/test/nanoswitch/BUILD
@@ -26,7 +26,7 @@
     name = "nanoswitch",
     embed = [":go_default_library"],
     pure = "on",
-    visibility = ["//visibility:public"],
+    visibility = ["//visibility:private"],
 )
 
 node_initramfs(
@@ -37,5 +37,5 @@
         # CA Certificate bundle
         "@cacerts//file": "/etc/ssl/cert.pem",
     },
-    visibility = ["//visibility:public"],
+    visibility = ["//metropolis/test:__subpackages__"],
 )