feat(workflow): diploma-eligibility DMN routes foreign diplomas via CBGV-advies (S-13, closes #14) (#101)

## What & why

S-13: a diploma's origin decides its route. A **DMN** (`diploma-eligibility`) is evaluated inline by
the registratie process as a **`businessRuleTask`**; an exclusive gateway routes a **foreign**
(Buitenlands) diploma through a new **CBGVAdvies** user task before `Beoordelen`, a **domestic** one
straight there (PRD flow 4). The domain's only new job is carrying the diploma origin and passing it
as a process start variable.

Chose **Option B (DMN in the BPMN)** over the issue's literal "evaluated by the Domain Service via
Workflow Client" wording — keeps the decision a first-class workflow artefact and §8.2 clean.
Rationale in **ADR-0016** (proposal #100); noted on this issue.

Closes #14

## Definition of Done

- [x] Linked Gitea issue (above).
- [x] Failing test committed before the implementation.
- [x] Implementation makes the test pass.
- [x] Conventional Commits referencing the issue (`refs #14`).
- [ ] CI green — all Gitea Actions jobs.
- [x] `docker compose up` from a fresh clone reaches green health checks within 3 minutes (additive; DMN deployed by flowable-init).
- [x] Docs updated (ADR-0016, demo note).
- [x] ADR added (`docs/architecture/adr-0016-diploma-eligibility-dmn.md`).
- [x] Demo note in `docs/demo-script.md`.

## How it was built (TDD)

- **Domain**: `DiplomaOrigin` on the aggregate + submit command; threaded through the process-start port so the Workflow Client emits a `diplomaOrigin` start variable. Red → green.
- **DMN + BPMN**: `workflows/diploma-eligibility.dmn` (origin → route); `businessRuleTask` + exclusive gateway + `CBGVAdvies` user task in `registratie.bpmn`; DMN deployed to Flowable's DMN engine by `flowable-init`.
- **Both paths**: `Een diploma op herkomst routeren` acceptance scenarios (origin carried into the process) + unit tests; verify-domain drives a foreign registration through CBGVAdvies→Beoordelen and the domestic one straight to Beoordelen — exercising both DMN branches live.

## Notes for reviewers

- Deviation from the issue's Option-A wording is deliberate and recorded (ADR-0016); the outcome is unchanged.
- The self-service eIDAS→foreign wiring is out of scope here (this slice is area:domain + area:workflow); the domain submit accepts an optional `diplomaOrigin` so the foreign path is drivable.
- Local green: domain unit 109, acceptance 15, `dotnet format`, Release build (0 errors), **domain mutation 95.39%** (break 90). The DMN/`businessRuleTask` REST wiring is CI-verified on verify-stack (no local full-stack run here).

Reviewed-on: #101

tests/acceptance/Features/EenDiplomaRouteren.feature

@@ -0,0 +1,19 @@
+# language: en
+# Drives S-13 (#14). A registration's diploma origin decides its route: a domestic (Binnenlands)
+# diploma goes straight to beoordeling, a foreign (Buitenlands) one is routed through an extra
+# CBGV-advies step (PRD flow 4). The decision itself is a DMN evaluated inside the workflow
+# (ADR-0016); the domain's part — verified here — is carrying the origin into the process so the DMN
+# can route on it. The DMN evaluation and the CBGV routing are verified live (verify-domain).
+Feature: Een diploma op herkomst routeren
+  Als register wil ik een aanvraag met een buitenlands diploma extra laten toetsen
+  zodat een CBGV-advies wordt ingewonnen voordat een behandelaar beoordeelt.
+
+  Scenario: Een binnenlands diploma start de registratie als binnenlands
+    Given a zorgprofessional with a "Binnenlands" diploma
+    When they submit their registration
+    Then the registratie process is started carrying a "Binnenlands" diploma
+
+  Scenario: Een buitenlands diploma start de registratie als buitenlands
+    Given a zorgprofessional with a "Buitenlands" diploma
+    When they submit their registration
+    Then the registratie process is started carrying a "Buitenlands" diploma

tests/acceptance/Steps/EenDiplomaRouterenSteps.cs

@@ -0,0 +1,36 @@
+using Acceptance.Support;
+using Big.Application;
+using Big.Domain;
+using Reqnroll;
+using Xunit;
+
+namespace Acceptance.Steps;
+
+/// <summary>Bindings for <c>EenDiplomaRouteren.feature</c> (S-13). Drives the submit use case against
+/// in-memory ports and asserts the registratie process is started carrying the diploma origin — the
+/// domain's contribution to flow 4. The DMN evaluation and the foreign→CBGV-advies routing it drives
+/// are verified live (verify-domain); one instance per scenario.</summary>
+[Binding]
+[Scope(Feature = "Een diploma op herkomst routeren")]
+public sealed class EenDiplomaRouterenSteps
+{
+    private readonly InMemoryRegistrationStore _store = new();
+    private readonly InMemoryWorkflowClient _workflow = new();
+    private DiplomaOrigin _origin;
+
+    [Given("a zorgprofessional with a \"(.*)\" diploma")]
+    public void GivenAZorgprofessionalWithADiploma(string origin)
+        => _origin = Enum.Parse<DiplomaOrigin>(origin, ignoreCase: true);
+
+    [When("they submit their registration")]
+    public async Task WhenTheySubmitTheirRegistration()
+        => await new SubmitRegistration(_store, _workflow).HandleAsync(
+            new SubmitRegistrationCommand("123456782", _origin));
+
+    [Then("the registratie process is started carrying a \"(.*)\" diploma")]
+    public void ThenTheProcessIsStartedCarryingTheDiploma(string expected)
+    {
+        Assert.NotNull(_workflow.StartedFor);
+        Assert.Equal(Enum.Parse<DiplomaOrigin>(expected, ignoreCase: true), _workflow.StartedWithOrigin);
+    }
+}

tests/acceptance/Support/InMemoryDomainPorts.cs

@@ -12,11 +12,14 @@ public sealed class InMemoryWorkflowClient : IWorkflowClient
     public const string StartedProcessInstanceId = "proc-acc-1";
 
     public RegistrationId? StartedFor { get; private set; }
+    public DiplomaOrigin? StartedWithOrigin { get; private set; }
     public string? WithdrawnProcessInstanceId { get; private set; }
 
-    public Task<string> StartRegistrationProcessAsync(RegistrationId registrationId, CancellationToken ct = default)
+    public Task<string> StartRegistrationProcessAsync(
+        RegistrationId registrationId, DiplomaOrigin diplomaOrigin, CancellationToken ct = default)
     {
         StartedFor = registrationId;
+        StartedWithOrigin = diplomaOrigin;
         return Task.FromResult(StartedProcessInstanceId);
     }