Spec 0009 D5. Supplies NewProviderAt, so the harness can point this provider at
a server it controls and prove each refusal is named with the right sentinel.

This provider speaks plain net/http rather than an SDK, so a status is all its
mapping has to go on and ORDER is the only thing protecting it — settling rate
limiting before permission. That ordering now has a mechanical check behind it
rather than a comment.

No MissingTag: Bitbucket Downloads has no tag concept, so GetReleaseByTag opts
out with ErrNotSupported and the harness checks the opt-out protocol instead.

Requires forge v0.14.0 for NewProviderAt.

Spec 0008 D4. forge has exposed WithHTTPTransport and WithHTTPClient since
v0.13.0 and this adapter read neither: the factory took opts ...forge.Option,
consulted Options.Logger, and dropped the rest. A consumer injecting a transport
to share a connection pool got no effect and no error.

Settings gains HTTPTransport and HTTPClient, the factory copies them from the
options, and the provider now holds two clients rather than one:

  - httpClient, from apiClient, honours both rungs and serves the API paths —
    the downloads listing, repository discovery and SSH-key management.
  - downloadClient, from pooledClient, shares a supplied transport and
    DELIBERATELY IGNORES a supplied client. It serves the two paths that fetch a
    URL the release AUTHOR chose.

The split needed care here that the other adapters did not, because
fetchDownloadsPage also calls setBasicAuthIfHostMatches: a blanket "anything
attaching a credential is a download" rule sends an API call down the pooled path
and silently drops a caller's injected client from it. That is the partial
adoption this decision warns about — a pool that covers some of the traffic reads
as one that covers all of it. TestTheDownloadsListingUsesTheAPIClient pins the
boundary, and fails against exactly that mutation.

Ignoring a supplied client for downloads is a security decision. A caller's
client carries the caller's policy, and may carry the caller's credentials in
headers the standard library does not know to strip — it protects Authorization,
Cookie and WWW-Authenticate on a cross-host redirect, and nothing else. We cannot
inspect a supplied client to find out. The transport is still shared, so no
pooling is lost.

Every behaviour is falsified against the mutant that removes it.