docs(workflow): ADR-0016 + demo note for diploma-eligibility DMN (S-13, refs #14)

Record the DMN-as-businessRuleTask decision (from proposal #100) and add the S-13
demo walkthrough showing a foreign diploma routing through CBGV-advies.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

docs/demo-script.md

@@ -343,3 +343,42 @@ candidate group behandelaar → teamlead (§8.2).
 > Both branches (escalate after 14 days; no-op when completed in time) are covered by the
 > `Een beoordeling escaleren` acceptance scenarios and the Workflow Client unit tests; the timer firing
 > and reassignment are asserted live by the verify-domain check.
+
+## S-13 — Diploma-eligibility: foreign diplomas route through CBGV-advies (#14, ADR-0016)
+
+A registration's diploma origin decides its route. A DMN `businessRuleTask` in the registratie
+process evaluates the `diploma-eligibility` decision on the `diplomaOrigin` start variable: a
+**foreign** (Buitenlands) diploma is routed through an extra **CBGV-advies** user task before
+beoordeling; a **domestic** (Binnenlands) one goes straight to beoordeling. The decision lives in the
+DMN, not in code — a beheerder can read and adjust the decision table directly.
+
+The self-service portal's eIDAS→foreign wiring is a later slice; for now the origin is submitted to
+the domain directly, so the demo drives it through the domain endpoint:
+
+```bash
+# 1. Submit a foreign-diploma registration to the domain (note the returned Location/reference):
+DOM=http://localhost:8080   # domain service
+curl -s -i -X POST "$DOM/registrations" -H 'Content-Type: application/json' \
+  -d '{"bsn":"123456782","diplomaOrigin":"Buitenlands"}' | grep -i '^location:'
+#
+# 2. Once the zaak is opened, the process parks at the CBGV-advies task (NOT Beoordelen). In Flowable:
+FL=http://localhost:8090/flowable-rest/service
+curl -s -u rest-admin:test -X POST "$FL/query/tasks" -H 'Content-Type: application/json' \
+  -d '{"processDefinitionKey":"registratie","taskDefinitionKey":"CBGVAdvies"}' | python3 -m json.tool
+#
+# 3. Complete the CBGV-advies task; the case then advances to the regular Beoordelen task:
+TID=$(curl -s -u rest-admin:test -X POST "$FL/query/tasks" -H 'Content-Type: application/json' \
+  -d '{"processDefinitionKey":"registratie","taskDefinitionKey":"CBGVAdvies"}' \
+  | python3 -c 'import sys,json;print(json.load(sys.stdin)["data"][0]["id"])')
+curl -s -u rest-admin:test -X POST "$FL/runtime/tasks/$TID" \
+  -H 'Content-Type: application/json' -d '{"action":"complete"}'
+# A domestic submission (default, or "Binnenlands") skips CBGV-advies and parks straight at Beoordelen.
+```
+
+**The path:** domain sets the `diplomaOrigin` start variable → registratie process DMN
+`businessRuleTask` sets `route` → exclusive gateway → foreign: `CBGVAdvies` user task → `Beoordelen`;
+domestic: `Beoordelen` directly (§8.2, ADR-0016).
+
+> The domestic/foreign paths are covered by the `Een diploma op herkomst routeren` acceptance
+> scenarios and unit tests (the origin is carried into the process); the DMN decision and the
+> foreign→CBGV routing are asserted live by the verify-domain check.