feat(workflow): diploma-eligibility DMN routes foreign diplomas via CBGV-advies (S-13, closes #14) (#101)

## What & why

S-13: a diploma's origin decides its route. A **DMN** (`diploma-eligibility`) is evaluated inline by
the registratie process as a **`businessRuleTask`**; an exclusive gateway routes a **foreign**
(Buitenlands) diploma through a new **CBGVAdvies** user task before `Beoordelen`, a **domestic** one
straight there (PRD flow 4). The domain's only new job is carrying the diploma origin and passing it
as a process start variable.

Chose **Option B (DMN in the BPMN)** over the issue's literal "evaluated by the Domain Service via
Workflow Client" wording — keeps the decision a first-class workflow artefact and §8.2 clean.
Rationale in **ADR-0016** (proposal #100); noted on this issue.

Closes #14

## Definition of Done

- [x] Linked Gitea issue (above).
- [x] Failing test committed before the implementation.
- [x] Implementation makes the test pass.
- [x] Conventional Commits referencing the issue (`refs #14`).
- [ ] CI green — all Gitea Actions jobs.
- [x] `docker compose up` from a fresh clone reaches green health checks within 3 minutes (additive; DMN deployed by flowable-init).
- [x] Docs updated (ADR-0016, demo note).
- [x] ADR added (`docs/architecture/adr-0016-diploma-eligibility-dmn.md`).
- [x] Demo note in `docs/demo-script.md`.

## How it was built (TDD)

- **Domain**: `DiplomaOrigin` on the aggregate + submit command; threaded through the process-start port so the Workflow Client emits a `diplomaOrigin` start variable. Red → green.
- **DMN + BPMN**: `workflows/diploma-eligibility.dmn` (origin → route); `businessRuleTask` + exclusive gateway + `CBGVAdvies` user task in `registratie.bpmn`; DMN deployed to Flowable's DMN engine by `flowable-init`.
- **Both paths**: `Een diploma op herkomst routeren` acceptance scenarios (origin carried into the process) + unit tests; verify-domain drives a foreign registration through CBGVAdvies→Beoordelen and the domestic one straight to Beoordelen — exercising both DMN branches live.

## Notes for reviewers

- Deviation from the issue's Option-A wording is deliberate and recorded (ADR-0016); the outcome is unchanged.
- The self-service eIDAS→foreign wiring is out of scope here (this slice is area:domain + area:workflow); the domain submit accepts an optional `diplomaOrigin` so the foreign path is drivable.
- Local green: domain unit 109, acceptance 15, `dotnet format`, Release build (0 errors), **domain mutation 95.39%** (break 90). The DMN/`businessRuleTask` REST wiring is CI-verified on verify-stack (no local full-stack run here).

Reviewed-on: #101

services/domain/Big.Domain/DiplomaOrigin.cs

@@ -0,0 +1,17 @@
+namespace Big.Domain;
+
+/// <summary>
+/// Where a zorgprofessional's diploma was issued. It is the input to the diploma-eligibility decision
+/// (S-13): a <see cref="Buitenlands"/> (foreign) diploma routes the registratie through an extra
+/// CBGV-advies assessment step, a <see cref="Binnenlands"/> (domestic) one goes straight to beoordeling.
+/// The decision itself lives in the workflow's DMN, not here (ADR-0016); the domain only carries the
+/// origin and hands it to the process as a start variable.
+/// </summary>
+public enum DiplomaOrigin
+{
+    /// <summary>A Dutch (domestic) diploma. Default for a registration submitted via DigiD.</summary>
+    Binnenlands,
+
+    /// <summary>A foreign diploma (e.g. an eIDAS submission). Triggers the CBGV-advies step.</summary>
+    Buitenlands,
+}

services/domain/Big.Domain/Registration.cs

@@ -7,10 +7,11 @@ namespace Big.Domain;
 /// </summary>
 public sealed class Registration
 {
-    private Registration(RegistrationId id, string bsn)
+    private Registration(RegistrationId id, string bsn, DiplomaOrigin diplomaOrigin)
     {
         Id = id;
         Bsn = bsn;
+        DiplomaOrigin = diplomaOrigin;
         Status = RegistrationStatus.Ingediend;
     }
 
@@ -20,6 +21,10 @@ public sealed class Registration
     /// as the domain payload; the domain never constructs ZGW concepts from it (§8.1).</summary>
     public string Bsn { get; }
 
+    /// <summary>Where the diploma was issued. Rides along to the process as a start variable and
+    /// drives the diploma-eligibility DMN's foreign→CBGV-advies routing (S-13, ADR-0016).</summary>
+    public DiplomaOrigin DiplomaOrigin { get; }
+
     public RegistrationStatus Status { get; private set; }
 
     /// <summary>The Flowable process instance driving this registration, once started.</summary>
@@ -28,11 +33,13 @@ public sealed class Registration
     /// <summary>The zaak the ACL opened for this registration, once the external task has run.</summary>
     public Uri? ZaakUrl { get; private set; }
 
-    /// <summary>Submit a new registration. It begins in <see cref="RegistrationStatus.Ingediend"/>.</summary>
-    public static Registration Submit(string bsn)
+    /// <summary>Submit a new registration. It begins in <see cref="RegistrationStatus.Ingediend"/>.
+    /// The diploma origin defaults to <see cref="DiplomaOrigin.Binnenlands"/> — the common DigiD path;
+    /// a foreign (eIDAS) submission passes <see cref="DiplomaOrigin.Buitenlands"/>.</summary>
+    public static Registration Submit(string bsn, DiplomaOrigin diplomaOrigin = DiplomaOrigin.Binnenlands)
     {
         ArgumentException.ThrowIfNullOrWhiteSpace(bsn);
-        return new Registration(RegistrationId.New(), bsn);
+        return new Registration(RegistrationId.New(), bsn, diplomaOrigin);
     }
 
     /// <summary>Record that the registratie workflow process has been started for this registration.</summary>