Found by a documentation audit against the source, run after a sibling audit of
the forge module found twenty drift findings.

Three shapes, each shared with the other adapters:

  - The "Use it" snippet called factory(source, cfg). `source` is undefined — it
    is the name of the type the Endpoint cut replaced — and the call is missing
    ctx entirely. ProviderFactory is
    func(ctx, ep forge.Endpoint, cfg forge.Config, opts ...forge.Option), so the
    snippet has not compiled since that cut. Verified by compiling it.
  - ReleaseSource.Host appeared in the self-hosted instructions. The type does
    not exist; the field is Endpoint.Host.
  - key.go's UploadKey godoc pointed at [Settings.Auth]. There is no Auth field,
    so pkg.go.dev rendered a link to nothing. It is Settings.Credential.
  - discovery.go and issues.go cited specs by a docs/development/specs/<date>.md
    path. forge moved every spec to the wiki on 2026-08-06 and those paths have
    not resolved since; they now cite the wiki pages by number.

The audit found nothing wrong in the security documentation, which was the part
worth checking here: this module attaches PRIVATE-TOKEN by hand and the standard
library does not strip that custom header across a redirect, so the README's
account of forge.HostTrusted and the sensitive-header policy had to be exact. It
matches release.go word for word.