org.jboss.as.controller-client is "public" in the broad sense. It's the API clients of the management system are expected to use. Having deployments act as clients of the management system is a bit odd, but I suppose someone will have a good use case.
I don't see any reason for org.jboss.as.domain-http-api to be public. If you want to manage the AS via HTTP, use HTTP. :)