Client for Backplane's distribution API (not an Agent Plugins registry standard).

Transport is injected as a function receiving %{method: method, url: url, headers: [{name, value}], body: nil_or_json_binary} and returning {:ok, %{status: integer, body: binary_or_decoded_json}} | {:error, reason}. The caller owns timeouts, TLS verification, redirect policy and response byte limits. Authorization must never be forwarded to another origin on redirects. auth accepts a bearer string or a zero-arity function returning header pairs.