feat(workflow): beoordeling escalation to teamlead after 14 days (S-14, closes #15) (#99)

## What & why

S-14: a beoordeling a behandelaar does not pick up within **14 days** escalates to the **teamlead**.

A non-interrupting `P14D` boundary timer on the `Beoordelen` user task fires an external-worker task
(`BeoordelingEscaleren`); the domain's escalation worker reassigns the still-open task's candidate group
from `behandelaar` to `teamlead`. The task keeps its identity — only who may claim it changes. The
escalation-via-external-worker decision is recorded in **ADR-0015** (proposal #98); it upholds §8.2
(the Workflow Client stays the only code that talks to Flowable) and keeps Flowable a stock image.

Closes #15

## Definition of Done

- [x] Linked Gitea issue (above).
- [x] Failing test committed before the implementation.
- [x] Implementation makes the test pass; refactor commit if structure improved.
- [x] Conventional Commits referencing the issue (`refs #NN`).
- [x] CI green — all Gitea Actions jobs.
- [x] `docker compose up` from a fresh clone reaches green health checks within 3 minutes (no new services; escalation is additive to the domain worker).
- [x] Docs updated (ADR-0015, demo note).
- [x] ADR added (`docs/architecture/adr-0015-beoordeling-escalation.md`).
- [x] Demo note in `docs/demo-script.md`.

## How it was built (TDD)

- **Workflow Client** (`IBeoordelingEscalatieClient`): acquire `BeoordelingEscaleren` jobs → find the open `Beoordelen` task in the instance → add `teamlead`/remove `behandelaar` candidate group → complete the job. Red → green.
- **Escalation drain loop** (`BeoordelingEscalatieProcessor`) + hosted `BeoordelingEscalatiePump`, mirroring the OpenZaak worker. Red → green.
- **BPMN**: non-interrupting `P14D` boundary timer on `Beoordelen` → external task → escalation end.
- **Both branches** (escalate after timeout; no-op when completed in time) covered by the `Een beoordeling escaleren` acceptance scenarios + Workflow Client unit tests.
- **Live integration**: `verify-domain` fires the timer early via Flowable's management API and asserts the reassignment to teamlead.

## Notes for reviewers

- Interface segregation: escalation is on `IBeoordelingEscalatieClient`, separate from the OpenZaak worker's `IExternalWorkerClient`.
- Reassignment is two REST hops (add teamlead, remove behandelaar); idempotent on redelivery — see ADR-0015 consequences.
- Local checks green: domain unit tests (104), acceptance (13), `dotnet format --verify-no-changes`, Release build (0 errors), **domain mutation 96.69%** (break 90). The `run-domain-check.sh` escalation path is CI-verified on verify-stack (local full-stack run is constrained here).
- `BeoordelingEscalatiePump` excluded from mutation, mirroring the existing `OpenZaakJobPump` exclusion.

Reviewed-on: #99

infra/run-domain-check.sh

@@ -157,4 +157,82 @@ for _ in $(seq 1 15); do
 done
 [ -n "$gone" ] || { echo "FAIL — Beoordelen task for $reg_id2 still active after withdrawal" >&2; docker logs "$dom" 2>&1 | tail -15 >&2; exit 1; }
 echo "OK — withdrawal cancelled the Beoordelen task; the registratie process ended (ingetrokken)"
+
+# ── S-14: escalation. A third registration parks at Beoordelen. We fire its 14-day boundary timer
+# early via Flowable's management API (the timer job is moved to executable and run), which routes a
+# parallel token to the BeoordelingEscaleren external task. The domain's escalation worker acquires
+# it and reassigns the still-open Beoordelen task from the behandelaar group to teamlead (ADR-0015). ─
+echo ">> submitting a third registration to escalate"
+loc3="$(docker run --rm --network "$net" curlimages/curl:latest \
+  -fsS -D - -o /dev/null -X POST "http://$dom_ip:8080/registrations" \
+  -H 'Content-Type: application/json' -d '{"bsn":"123456782"}' \
+  | sed -n 's/\r$//; s/^[Ll]ocation: //p' | head -1)"
+[ -n "$loc3" ] || { echo "FAIL — third POST /registrations returned no Location" >&2; exit 1; }
+reg_id3="${loc3##*/}"
+echo ">> third registration $reg_id3"
+
+# Extracts "<taskId> <processInstanceId>" for a registration from a task-query response on stdin.
+task_and_pid_for_reg() { REG_ID="$1" python3 -c "import os,sys,json
+try:
+    d=json.load(sys.stdin)
+except Exception:
+    d={}
+rid=os.environ['REG_ID']
+t=next((t for t in (d.get('data') or [])
+    if any(v.get('name')=='registrationId' and v.get('value')==rid for v in (t.get('variables') or []))), None)
+print(f\"{t['id']} {t['processInstanceId']}\" if t else '')"; }
+
+# The candidate groups on a task (space-separated, sorted) from a runtime identitylinks response.
+candidate_groups() { python3 -c "import sys,json
+try:
+    links=json.load(sys.stdin)
+except Exception:
+    links=[]
+print(' '.join(sorted(l.get('group') or '' for l in links if l.get('type')=='candidate' and l.get('group'))))"; }
+
+# The first job id in a management jobs/timer-jobs response on stdin.
+first_job_id() { python3 -c "import sys,json
+try:
+    d=json.load(sys.stdin)
+except Exception:
+    d={}
+print(((d.get('data') or [{}])[0]).get('id',''))"; }
+
+echo ">> polling Flowable for its Beoordelen task"
+task_id3=""; pid3=""
+for _ in $(seq 1 30); do
+  resp="$(flcurl -X POST "$fl_base/query/tasks" -H 'Content-Type: application/json' -d "$query" 2>/dev/null || true)"
+  read -r task_id3 pid3 <<<"$(printf '%s' "$resp" | task_and_pid_for_reg "$reg_id3")"
+  [ -n "$task_id3" ] && break
+  sleep 2
+done
+[ -n "$task_id3" ] || { echo "FAIL — no Beoordelen task appeared for registration $reg_id3" >&2; docker logs "$dom" 2>&1 | tail -15 >&2; exit 1; }
+echo ">> Beoordelen task $task_id3 (instance $pid3) is waiting for the behandelaar"
+
+echo ">> asserting the task starts out claimable by the behandelaar group"
+before="$(flcurl "$fl_base/runtime/tasks/$task_id3/identitylinks" | candidate_groups)"
+[ "$before" = "behandelaar" ] || { echo "FAIL — expected candidate group 'behandelaar', got '$before'" >&2; exit 1; }
+
+echo ">> firing the 14-day boundary timer early via the management API"
+timer_id="$(flcurl "$fl_base/management/timer-jobs?processInstanceId=$pid3" | first_job_id)"
+[ -n "$timer_id" ] || { echo "FAIL — no timer job found for instance $pid3" >&2; exit 1; }
+# Move the timer job to an executable async job. Flowable's async executor (running in flowable-rest)
+# then picks it up and fires the non-interrupting boundary event. It may run the job before we can
+# look, so executing it explicitly is a best-effort nudge — tolerate the job already being gone.
+flcurl -X POST "$fl_base/management/timer-jobs/$timer_id" -H 'Content-Type: application/json' -d '{"action":"move"}' >/dev/null
+async_id="$(flcurl "$fl_base/management/jobs?processInstanceId=$pid3" 2>/dev/null | first_job_id || true)"
+if [ -n "$async_id" ]; then
+  flcurl -X POST "$fl_base/management/jobs/$async_id" -H 'Content-Type: application/json' -d '{"action":"execute"}' >/dev/null 2>&1 || true
+fi
+echo ">> timer fired; the BeoordelingEscaleren token is parked for the domain worker"
+
+echo ">> polling until the escalation worker reassigns the beoordeling to the teamlead"
+escalated=""
+for _ in $(seq 1 30); do
+  groups="$(flcurl "$fl_base/runtime/tasks/$task_id3/identitylinks" 2>/dev/null | candidate_groups || true)"
+  [ "$groups" = "teamlead" ] && { escalated=1; break; }
+  sleep 2
+done
+[ -n "$escalated" ] || { echo "FAIL — Beoordelen task not reassigned to teamlead (candidate groups: '$groups')" >&2; docker logs "$dom" 2>&1 | tail -15 >&2; exit 1; }
+echo "OK — the 14-day timer escalated the still-open Beoordelen task to the teamlead"
 exit 0