Maps Bitbucket's responses onto the forge sentinels released in v0.13.0.

This provider speaks plain net/http rather than an SDK, so a status is all
there is to go on — there is no typed error to prefer, as there is for
go-github. That makes the ORDER the only thing protecting the mapping,
which is why rate limiting is settled before permission. Bitbucket answers
a limit with 429; an exhausted budget advertised on a 403 is honoured too,
for an instance behind a proxy reporting GitHub-style.

describeStatus is folded into that mapping rather than left beside it.
It was doing half this job already — spec 0008 D8's private-repository
guidance, which moved from construction to the operation — and two
functions deciding what a status means is how they drift apart. The
guidance survives as hintCredential, still attached only when NO credential
was sent: a refusal with one is a permissions or rate-limit answer, and
telling that caller to set variables they already set sends them the wrong
way. Both halves keep their tests, and both die to their own mutants.

The mapping now also covers the paths describeStatus never reached: asset
downloads, checksum and signature fetches, and the discovery page walk. A
download is refused for the same reasons an API call is, and a caller
branching on the sentinels should not have to special-case the path it
happened to come from.

An unmapped status stays an ordinary error rather than being forced into
one of the four.

Implements forge spec 0009 D1, D2, D3 and D7 for this adapter.

A reset header names an absolute moment, so the delay derived from it
shrinks while the test runs. These assertions compared it against the span
the header was built with, which only holds when no time passes between
the two — true on a quiet machine, false under -race on a loaded runner,
where the gap reached 12 seconds and failed CI.

Both sides now move together, so the tolerance covers only the
microseconds between the provider reading the clock and the assertion
reading it.

The same mistake was made in every adapter, so it is fixed in every
adapter rather than only where it happened to fire first.