fix(domain): correlate withdrawal by process instance to the subscribed execution (refs #12)

verify-stack surfaced a Flowable 500: delivering messageEventReceived to the Beoordelen task's

execution is wrong — a message boundary event's subscription lives on its own execution. Correlate

instead by the registration's process instance id (recorded at submit): query the execution

subscribed to RegistratieIngetrokken and deliver the message there. Withdrawal moves from

IUserTaskClient to IWorkflowClient.WithdrawProcessAsync; the handler no longer needs a task lookup.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

docs/architecture/adr-0014-withdrawal-cancels-the-process.md

@@ -29,11 +29,12 @@ task; the Workflow Client correlates a `RegistratieIngetrokken` message to the t
   Client only delivers the message; it never reaches into Flowable to delete an instance. This keeps
   the workflow's control flow in the workflow (§8.2) and leaves an audit trail in Flowable history
   (the process ended via the ingetrokken path, not a raw delete).
-- **Correlated via the Beoordelen task's execution.** The `WithdrawRegistration` handler already
-  knows the registration; it finds the open `Beoordelen` task for it (the same task-query the werkbak
-  uses, §8.2) and asks the Workflow Client to deliver the withdrawal message to that task's execution
-  (`messageEventReceived`). No separate correlation store is needed — the werkbak task set is the
-  authoritative correlation, exactly as the beoordeling decision reuses it (ADR-0013).
+- **Correlated by the registration's own process instance.** The aggregate records its Flowable
+  process instance id at submit, so the `WithdrawRegistration` handler correlates directly by that
+  id — no task lookup. The Workflow Client asks Flowable for the execution **subscribed to** the
+  `RegistratieIngetrokken` message in that instance and delivers `messageEventReceived` to it.
+  Targeting the subscribed execution (not the user task's execution — a message boundary event's
+  subscription lives on its own execution) is what makes the correlation land.
 - **Best-effort, mirroring the beoordeling.** If no open `Beoordelen` task is found (the process has
   not yet parked there — the `OpenZaakAanmaken` window — or has already ended), the withdrawal still
   stands: the aggregate is INGETROKKEN and the werkbak filters it out regardless (S-11b). We complete