feat(infra): register RegisterRecord objecttype + published version in Objecttypen (refs #141)

The Objecttypen setup_configuration (3.4.2) can only provision tokens, with
no declarative objecttype step, so a registerrecord-init compose one-shot
creates the RegisterRecord objecttype + a published v1 over the API once
Objecttypen is healthy (idempotent; ADR-0020 self-seed pattern). The schema
(infra/objecttypen-registerrecord/registerrecord.schema.json) is public-safe
— id, status, reference — mirroring the BFF's OpenbaarEntry, no bsn/naam;
dataClassification 'open'. S-19 writes records against it on approval.

Config (schema + register.py) is streamed into rr-registerrecord-config by
seed-config.sh (main) / bind-mounted (local), same dual pattern as the
setup_configuration volumes. Wired into SEED, CFG_VOLS, and the CI log-dump.

Verified locally: registerrecord-init registered RegisterRecord v1 published,
make verify-registerrecord green, and a re-run is a no-op.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

infra/docker-compose.yml

@@ -640,6 +640,25 @@ services:
         condition: service_completed_successfully
     networks: [cg]
 
+  # ── RegisterRecord objecttype (S-18c) — API-seeded one-shot ────────────────
+  # The Objecttypen setup_configuration (3.4.2) can only provision tokens — no declarative objecttype
+  # step — so this one-shot creates the RegisterRecord objecttype + a published version over the API
+  # once Objecttypen is healthy (idempotent; ADR-0020 self-seed, ADR-0027 schema). The schema + script
+  # are streamed into the external config volume by infra/seed-config.sh, like the *-init volumes.
+  registerrecord-init:
+    image: docker.io/library/python:3-slim
+    environment:
+      OBJECTTYPEN: http://objecttypen:8000
+      OBJECTTYPEN_TOKEN: ${OBJECTTYPEN_TOKEN:-0123456789abcdef0123456789abcdef01234567}
+      SCHEMA: /config/registerrecord.schema.json
+    command: python /config/register.py
+    volumes:
+      - registerrecord-config:/config:ro
+    depends_on:
+      objecttypen:
+        condition: service_healthy
+    networks: [cg]
+
   # ── Objecten API (S-18b) — upstream Maykin image, verbatim ─────────────────
   # The authoritative object store. Same shape as Objecttypen (own DB + redis, an `-init` that runs
   # setup_configuration from the external config volume, a health-checked web). Two differences: the
@@ -782,6 +801,9 @@ volumes:
   objecttypen-config:
     external: true
     name: rr-objecttypen-config
+  registerrecord-config:
+    external: true
+    name: rr-registerrecord-config
   objecten-config:
     external: true
     name: rr-objecten-config