test(acl,domain): cover the approval-flow mutants to hold the ratchet (refs #75)

The new gateway/use-case code left surviving mutants (empty NoCoverage on the ACL
gateway status-set, plus unasserted error messages, null-guards, and the persist
call). Add stub-handler tests for SetZaakToEindstatusAsync (eindstatus resolution,
POST framing, failure paths) and assert the approve use case's messages, null
handling and SaveAsync. Local Stryker: acl 100%, domain 98.4%, event-subscriber 100%.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

services/domain/Big.Tests/RegistrationTests.cs

@@ -117,7 +117,8 @@ public class RegistrationTests
         registration.AttachZaak(new Uri("http://openzaak/zaken/api/v1/zaken/abc"));
         registration.Approve();
 
-        Assert.Throws<InvalidOperationException>(() => registration.Approve());
+        var ex = Assert.Throws<InvalidOperationException>(() => registration.Approve());
+        Assert.Contains("only an INGEDIEND", ex.Message);
         Assert.Equal(RegistrationStatus.Ingeschreven, registration.Status);
     }
 }