feat(event-subscriber): project a status-set as INGESCHREVEN via hoofdObject (refs #75)

Bind the NRC hoofdObject, recognise a zaken/status/create notification, and key the
projection on the zaak (hoofdObject) so the status updates the existing INGEDIEND row
to INGESCHREVEN — without reading OpenZaak (§8.1). Retain the ZGW resource in the log
(new column + migration) so a rebuild reproduces the approved status. Updates the
acceptance fakes for the new IAclClient/IZaakGateway members.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

services/event-subscriber/EventSubscriber.Application/Notification.cs

@@ -11,14 +11,23 @@ public sealed record Notification(
     string Kanaal,
     string Resource,
     string Actie,
-    Uri ResourceUrl)
+    Uri ResourceUrl,
+    Uri? HoofdObject = null)
 {
-    /// <summary>The only event the walking-skeleton projection reacts to: a zaak being created.</summary>
+    /// <summary>A zaak being created — projected as INGEDIEND.</summary>
     public bool IsZaakCreated =>
         Kanaal == "zaken" && Resource == "zaak" && Actie == "create";
 
-    /// <summary>The zaak UUID — the trailing path segment of the resource URL — used as the projection key.</summary>
-    public string ZaakId => ResourceUrl.Segments[^1].Trim('/');
+    /// <summary>A status being set on a zaak — the approval, projected as INGESCHREVEN (S-09b). In the
+    /// walking skeleton the only status ever set after creation is the approval, and the subscriber may
+    /// not read OpenZaak (§8.1), so any status-create is taken as the approval.</summary>
+    public bool IsZaakStatusSet =>
+        Kanaal == "zaken" && Resource == "status" && Actie == "create";
+
+    /// <summary>The zaak UUID used as the projection key. For a status notification the resource URL is
+    /// the status, so the zaak comes from <c>hoofdObject</c> (which, for a zaak-create, equals the
+    /// resource URL) — see the NRC payload note.</summary>
+    public string ZaakId => (HoofdObject ?? ResourceUrl).Segments[^1].Trim('/');
 
     /// <summary>
     /// A deterministic dedup key. Open Notificaties carries no notification id and may