more tweaks. stub HTTP-only tls.py. client separation into base and CI workflow client. Still need a ListenerClient API.