feat(workflow): diploma-eligibility DMN routes foreign diplomas via CBGV-advies (S-13, closes #14) (#101)

## What & why

S-13: a diploma's origin decides its route. A **DMN** (`diploma-eligibility`) is evaluated inline by
the registratie process as a **`businessRuleTask`**; an exclusive gateway routes a **foreign**
(Buitenlands) diploma through a new **CBGVAdvies** user task before `Beoordelen`, a **domestic** one
straight there (PRD flow 4). The domain's only new job is carrying the diploma origin and passing it
as a process start variable.

Chose **Option B (DMN in the BPMN)** over the issue's literal "evaluated by the Domain Service via
Workflow Client" wording — keeps the decision a first-class workflow artefact and §8.2 clean.
Rationale in **ADR-0016** (proposal #100); noted on this issue.

Closes #14

## Definition of Done

- [x] Linked Gitea issue (above).
- [x] Failing test committed before the implementation.
- [x] Implementation makes the test pass.
- [x] Conventional Commits referencing the issue (`refs #14`).
- [ ] CI green — all Gitea Actions jobs.
- [x] `docker compose up` from a fresh clone reaches green health checks within 3 minutes (additive; DMN deployed by flowable-init).
- [x] Docs updated (ADR-0016, demo note).
- [x] ADR added (`docs/architecture/adr-0016-diploma-eligibility-dmn.md`).
- [x] Demo note in `docs/demo-script.md`.

## How it was built (TDD)

- **Domain**: `DiplomaOrigin` on the aggregate + submit command; threaded through the process-start port so the Workflow Client emits a `diplomaOrigin` start variable. Red → green.
- **DMN + BPMN**: `workflows/diploma-eligibility.dmn` (origin → route); `businessRuleTask` + exclusive gateway + `CBGVAdvies` user task in `registratie.bpmn`; DMN deployed to Flowable's DMN engine by `flowable-init`.
- **Both paths**: `Een diploma op herkomst routeren` acceptance scenarios (origin carried into the process) + unit tests; verify-domain drives a foreign registration through CBGVAdvies→Beoordelen and the domestic one straight to Beoordelen — exercising both DMN branches live.

## Notes for reviewers

- Deviation from the issue's Option-A wording is deliberate and recorded (ADR-0016); the outcome is unchanged.
- The self-service eIDAS→foreign wiring is out of scope here (this slice is area:domain + area:workflow); the domain submit accepts an optional `diplomaOrigin` so the foreign path is drivable.
- Local green: domain unit 109, acceptance 15, `dotnet format`, Release build (0 errors), **domain mutation 95.39%** (break 90). The DMN/`businessRuleTask` REST wiring is CI-verified on verify-stack (no local full-stack run here).

Reviewed-on: #101

services/domain/Big.Tests/FlowableWorkflowClientTests.cs

@@ -24,7 +24,7 @@ public class FlowableWorkflowClientTests
         var client = Client(capture.Responds(HttpStatusCode.Created, """{"id":"pi-1"}"""));
         var rid = RegistrationId.New();
 
-        var pid = await client.StartRegistrationProcessAsync(rid);
+        var pid = await client.StartRegistrationProcessAsync(rid, DiplomaOrigin.Binnenlands);
 
         Assert.Equal("pi-1", pid);
         Assert.Equal(HttpMethod.Post, capture.Seen!.Method);
@@ -38,6 +38,22 @@ public class FlowableWorkflowClientTests
         Assert.Contains($"\"value\":\"{rid}\"", capture.Body);
     }
 
+    [Theory]
+    [InlineData(DiplomaOrigin.Binnenlands, "Binnenlands")]
+    [InlineData(DiplomaOrigin.Buitenlands, "Buitenlands")]
+    public async Task Start_posts_the_diploma_origin_as_a_process_variable(DiplomaOrigin origin, string expected)
+    {
+        // The diploma origin rides along as a start variable so the workflow's DMN can route foreign
+        // diplomas through CBGV-advies (S-13, ADR-0016).
+        var capture = new RequestCapture();
+        var client = Client(capture.Responds(HttpStatusCode.Created, """{"id":"pi-1"}"""));
+
+        await client.StartRegistrationProcessAsync(RegistrationId.New(), origin);
+
+        Assert.Contains("\"name\":\"diplomaOrigin\"", capture.Body);
+        Assert.Contains($"\"value\":\"{expected}\"", capture.Body);
+    }
+
     [Fact]
     public async Task Start_uses_the_configured_worker_credentials_and_defaults()
     {
@@ -125,7 +141,7 @@ public class FlowableWorkflowClientTests
         var client = Client(capture.Responds(HttpStatusCode.InternalServerError));
 
         await Assert.ThrowsAsync<HttpRequestException>(
-            () => client.StartRegistrationProcessAsync(RegistrationId.New()));
+            () => client.StartRegistrationProcessAsync(RegistrationId.New(), DiplomaOrigin.Binnenlands));
     }
 
     [Fact]
@@ -135,7 +151,7 @@ public class FlowableWorkflowClientTests
         var client = Client(capture.Responds(HttpStatusCode.Created, "null"));
 
         var ex = await Assert.ThrowsAsync<InvalidOperationException>(
-            () => client.StartRegistrationProcessAsync(RegistrationId.New()));
+            () => client.StartRegistrationProcessAsync(RegistrationId.New(), DiplomaOrigin.Binnenlands));
         Assert.Contains("empty process-instance", ex.Message);
     }