is there any way to enforce that tests targets declare dependencies on data files? (python tests, if it matters) i.e., only expose the data files that a test declares, all other files shouldn’t be accessible

yep!