Spec 0008 D5 offers a native-client rung for the adapters that have a platform
SDK, and requires the ones that do not to document the absence so it does not
read as an oversight.

This module speaks the Bitbucket API over plain net/http. Its native unit IS the
*http.Client, so a rung taking one would duplicate forge.WithHTTPClient rather
than add anything. The ladder here therefore starts at the transport and client
rungs, which this module does honour.

Found by a documentation audit against the source, run after a sibling audit of
the forge module found twenty drift findings.

Two shapes shared with the other adapters:

  - The "Use it" snippet called factory(source, cfg). `source` is undefined — it
    is the name of the type the Endpoint cut replaced — and the call is missing
    ctx entirely. ProviderFactory is
    func(ctx, ep forge.Endpoint, cfg forge.Config, opts ...forge.Option), so the
    snippet has not compiled since that cut.
  - discovery.go cited a spec by a docs/development/specs/<date>.md path. forge
    moved every spec to the wiki on 2026-08-06 and that path has not resolved
    since; it now cites the wiki page by number.

Two are specific to this module, and both describe a safety check that no longer
exists.

The README said `ReleaseSource.Private: true` turns a missing credential into a
fast failure. That field went with ReleaseSourceConfig in spec 0008 D3, and the
check it fed moved to the operation in D8 — because whether the repository you
go on to ask about is private is not knowable at construction, since one
connection serves both. Nothing fails construction now. What happens instead is
that a refusal with no credential resolved carries guidance naming the variables
to set, which is a better error rather than an earlier one.

NewReleaseProvider's own godoc was worse, because it is the exported symbol a
reader trusts: it said absence of a credential is "only a failure for a private
repository, which is checked separately below". There is no such check below, or
anywhere in the function. The same commit that deleted the check left the comment
promising it, so the godoc has described a guarantee this constructor does not
make.