refactor: move tools/private/zipapp to tools/zipapp (#4127)

The `//tools/private` package is reserved for developer tools used to
maintain `rules_python`. The zipapp tools support rule execution and
belong under `//tools/` alongside tools like `launcher`.

Move `tools/private/zipapp` to `tools/zipapp`, update internal rule
attributes, adjust test imports and dependencies, update distribution
filegroups, and document the scope of `//tools/private`.
diff --git a/python/private/py_executable.bzl b/python/private/py_executable.bzl
index 368a785..d6f0119 100644
--- a/python/private/py_executable.bzl
+++ b/python/private/py_executable.bzl
@@ -227,7 +227,7 @@
         ),
         "_exe_zip_maker": lambda: attrb.Label(
             cfg = "exec",
-            default = "//tools/private/zipapp:exe_zip_maker",
+            default = "//tools/zipapp:exe_zip_maker",
         ),
         "_launcher": lambda: attrb.Label(
             cfg = "target",
diff --git a/python/private/zipapp/py_zipapp_rule.bzl b/python/private/zipapp/py_zipapp_rule.bzl
index 7e11b06..b664c1f 100644
--- a/python/private/zipapp/py_zipapp_rule.bzl
+++ b/python/private/zipapp/py_zipapp_rule.bzl
@@ -362,7 +362,7 @@
     ),
     "_exe_zip_maker": attr.label(
         cfg = "exec",
-        default = "//tools/private/zipapp:exe_zip_maker",
+        default = "//tools/zipapp:exe_zip_maker",
     ),
     "_launcher": attr.label(
         cfg = "target",
@@ -378,7 +378,7 @@
     ),
     "_zip_main_maker": attr.label(
         cfg = "exec",
-        default = "//tools/private/zipapp:zip_main_maker",
+        default = "//tools/zipapp:zip_main_maker",
     ),
     "_zip_shell_template": attr.label(
         default = ":zip_shell_template",
@@ -386,7 +386,7 @@
     ),
     "_zipper": attr.label(
         cfg = "exec",
-        default = "//tools/private/zipapp:zipper",
+        default = "//tools/zipapp:zipper",
     ),
 } | ({
     "_windows_launcher_maker": attr.label(
diff --git a/tests/tools/zipapp/BUILD.bazel b/tests/tools/zipapp/BUILD.bazel
index 97c8096..7943e40 100644
--- a/tests/tools/zipapp/BUILD.bazel
+++ b/tests/tools/zipapp/BUILD.bazel
@@ -5,19 +5,19 @@
     name = "zipper_test",
     srcs = ["zipper_test.py"],
     target_compatible_with = SUPPORTS_BZLMOD,
-    deps = ["//tools/private/zipapp:zipper_lib"],
+    deps = ["//tools/zipapp:zipper_lib"],
 )
 
 pytest_test(
     name = "exe_zip_maker_test",
     srcs = ["exe_zip_maker_test.py"],
     target_compatible_with = SUPPORTS_BZLMOD,
-    deps = ["//tools/private/zipapp:exe_zip_maker_lib"],
+    deps = ["//tools/zipapp:exe_zip_maker_lib"],
 )
 
 pytest_test(
     name = "zip_main_maker_test",
     srcs = ["zip_main_maker_test.py"],
     target_compatible_with = SUPPORTS_BZLMOD,
-    deps = ["//tools/private/zipapp:zip_main_maker_lib"],
+    deps = ["//tools/zipapp:zip_main_maker_lib"],
 )
diff --git a/tests/tools/zipapp/exe_zip_maker_test.py b/tests/tools/zipapp/exe_zip_maker_test.py
index 97df258..6257014 100644
--- a/tests/tools/zipapp/exe_zip_maker_test.py
+++ b/tests/tools/zipapp/exe_zip_maker_test.py
@@ -1,7 +1,7 @@
 import hashlib
 import stat
 
-from tools.private.zipapp import exe_zip_maker
+from tools.zipapp import exe_zip_maker
 
 
 def test_create_exe_zip(tmp_path):
diff --git a/tests/tools/zipapp/zip_main_maker_test.py b/tests/tools/zipapp/zip_main_maker_test.py
index 5c7f57c..c27ff88 100644
--- a/tests/tools/zipapp/zip_main_maker_test.py
+++ b/tests/tools/zipapp/zip_main_maker_test.py
@@ -1,7 +1,7 @@
 import hashlib
 import os
 
-from tools.private.zipapp import zip_main_maker
+from tools.zipapp import zip_main_maker
 
 
 def test_creates_zip_main(tmp_path, monkeypatch):
diff --git a/tests/tools/zipapp/zipper_test.py b/tests/tools/zipapp/zipper_test.py
index bbd85b6..e4f25c5 100644
--- a/tests/tools/zipapp/zipper_test.py
+++ b/tests/tools/zipapp/zipper_test.py
@@ -2,7 +2,7 @@
 import shutil
 import zipfile
 
-from tools.private.zipapp import zipper
+from tools.zipapp import zipper
 
 
 def symlink_target_path(p):
diff --git a/tools/BUILD.bazel b/tools/BUILD.bazel
index 7829b33..aa75c66 100644
--- a/tools/BUILD.bazel
+++ b/tools/BUILD.bazel
@@ -33,6 +33,7 @@
         "//tools/precompiler:distribution",
         "//tools/private:distribution",
         "//tools/publish:distribution",
+        "//tools/zipapp:distribution",
     ],
     visibility = ["//:__pkg__"],
 )
diff --git a/tools/private/BUILD.bazel b/tools/private/BUILD.bazel
index ae6951c..b395b2c 100644
--- a/tools/private/BUILD.bazel
+++ b/tools/private/BUILD.bazel
@@ -6,9 +6,7 @@
 
 filegroup(
     name = "distribution",
-    srcs = glob(["**"]) + [
-        "//tools/private/zipapp:distribution",
-    ],
+    srcs = glob(["**"]),
 )
 
 bzl_library(
diff --git a/tools/private/README.md b/tools/private/README.md
new file mode 100644
index 0000000..19b174e
--- /dev/null
+++ b/tools/private/README.md
@@ -0,0 +1,9 @@
+# Developer Tools (`//tools/private`)
+
+This directory contains development-only tools used for maintaining and
+developing `rules_python` itself (such as release management, dependency
+updating, review bots, and repository maintenance scripts).
+
+Supporting tools for rules (e.g. `launcher`, `precompiler`, `zipapp`,
+`publish`, `wheelmaker`) belong as their own top-level directories under
+`//tools/`.
diff --git a/tools/private/zipapp/BUILD.bazel b/tools/zipapp/BUILD.bazel
similarity index 100%
rename from tools/private/zipapp/BUILD.bazel
rename to tools/zipapp/BUILD.bazel
diff --git a/tools/private/zipapp/exe_zip_maker.py b/tools/zipapp/exe_zip_maker.py
similarity index 100%
rename from tools/private/zipapp/exe_zip_maker.py
rename to tools/zipapp/exe_zip_maker.py
diff --git a/tools/private/zipapp/zip_main_maker.py b/tools/zipapp/zip_main_maker.py
similarity index 100%
rename from tools/private/zipapp/zip_main_maker.py
rename to tools/zipapp/zip_main_maker.py
diff --git a/tools/private/zipapp/zipper.py b/tools/zipapp/zipper.py
similarity index 100%
rename from tools/private/zipapp/zipper.py
rename to tools/zipapp/zipper.py