docs(infra): ADR-0020 + demo note for the local-stack self-seed (refs #110)

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

docs/demo-script.md

@@ -5,6 +5,33 @@ copy-pasteable walkthrough against a local `make up` stack.
 
 ---
 
+## S-B04 — `make local` completes the whole flow with no manual seeding (#110, ADR-0020)
+
+**Outcome:** the host-browser stack (`make local`) now self-seeds at bring-up — it publishes the BIG
+zaaktype and wires the ACL to it, deploys the `diploma-eligibility` DMN, and registers the NRC
+abonnement — so a fresh bring-up runs submit → werkbak → openbaar without the manual seeding the
+`verify-*` scripts do for CI. (Previously the process stuck at `OpenZaakAanmaken`, the werkbak stayed
+empty, and the openbaar register showed nothing.)
+
+```bash
+# 1. Fresh bring-up (self-seeding init containers: local-seed, nrc-subscribe; DMN in flowable-init).
+make local
+
+# 2. Assert the whole flow works with no manual seeding — submit opens a zaak, documents route it to
+#    the werkbak, and the reference appears in the openbaar register:
+make verify-local     # → "OK — a fresh local stack completed the flow with no manual seeding ..."
+
+# 3. Or by hand in the browser: log in at http://localhost:8140 (jan-burger / test123), submit +
+#    upload a PDF, then approve it in the werkbak at http://localhost:8142 (merel-behandelaar /
+#    test123); it shows as INGESCHREVEN in the openbaar register at http://localhost:8141.
+```
+
+> The zaaktype UUID is server-assigned, so `local-seed` writes the real URL into a shared volume as
+> `acl.env` and the ACL sources it on startup (ADR-0020). The cleaner long-term fix — the ACL
+> resolving its zaaktype by `identificatie` — is tracked separately as S-27 (#113).
+
+---
+
 ## S-08d — Walking skeleton complete: browser → submit, end-to-end
 
 **Outcome:** the self-service portal is served in the stack and the full front-of-house happy path