fix(infra): docker-compose.local self-seeds zaaktype, DMN + NRC abonnement (closes #110) (#114)

## What & why

The host-browser stack (`make local`) had drifted behind three slices, so a fresh bring-up couldn't complete the flow: registrations stuck at `OpenZaakAanmaken`, the behandel werkbak stayed empty, and the openbaar register showed nothing. The `verify-*` scripts do this setup for CI at test time; `make local` had no equivalent.

This makes the local stack **self-seed at bring-up** so it just works in a browser:

- **DMN** — `flowable-init` now also deploys `diploma-eligibility.dmn` (was BPMN-only), so completing `WachtOpDocumenten` routes through the DMN to `Beoordelen` instead of 404ing.
- **Zaaktype + ACL** — a `local-seed` one-shot publishes the BIG zaaktype (whose UUID is server-assigned, hence not static in the compose file) and writes the real URLs to `seed-env:/acl.env`; the ACL sources it on startup via an entrypoint override.
- **NRC abonnement** — an `nrc-subscribe` one-shot registers the `zaken` subscription at the event-subscriber callback, so notifications reach the projection/openbaar register.

Both one-shots reach OpenZaak/NRC by **container IP** (a single-label host fails their Django URLValidator), mirroring the CI verify scripts. Design + trade-offs in **ADR-0020**.

Closes #110

## Definition of Done

- [x] Linked Gitea issue (#110).
- [x] Failing test committed before the implementation — `test(infra): …` adds `infra/run-local-flow-check.sh` / `make verify-local`; the three gaps' failures were observed live on a fresh `make local` (red), and the fix turns it green.
- [x] Implementation makes the test pass; docs commit follows.
- [x] Conventional Commits referencing the issue (`refs #110`).
- [ ] CI green — running on the restored runner. Infra-only change; the CI `verify-stack` job uses `docker-compose.yml` (untouched). Also validated locally: `make verify-local` passes against a fresh `make local` (see below).
- [x] `docker compose up` from a fresh clone reaches green health checks — verified: `make local` healthy in ~2m20s, then `make verify-local` green.
- [x] Docs updated — ADR-0020 + demo-script note.
- [x] ADR added in `docs/architecture/` — ADR-0020.
- [x] Demo note in `docs/demo-script.md`.

## Notes for reviewers

- **Infra-only** — no service code changes; the ACL image and the CI stack (`docker-compose.yml`) are untouched.
- **Verified end-to-end on a fresh stack** (`make local-down && make local && make verify-local`):
  ```
  >> 2. zaak opened            (zaaktype seeded + wired)
  >> 3. documents accepted 204 (DMN deployed)
  >> 4. in the werkbak         (DMN routing → Beoordelen)
  >> 5. visible in the openbaar register (NRC abonnement)
  OK — a fresh local stack completed the flow with no manual seeding
  ```
- **Follow-up:** the cleaner design — ACL resolving its zaaktype by `identificatie` instead of a pinned server-assigned URL — is split out as **S-27 (#113)**; landing it would remove the `acl.env` injection here. ADR-0020 records this.
- The `seed-env` volume carries the generated `acl.env` from `local-seed` to the ACL; a `down --volumes` (as `make local-down` does) resets it cleanly.

Reviewed-on: #114

docs/demo-script.md

@@ -5,6 +5,33 @@ copy-pasteable walkthrough against a local `make up` stack.
 
 ---
 
+## S-B04 — `make local` completes the whole flow with no manual seeding (#110, ADR-0020)
+
+**Outcome:** the host-browser stack (`make local`) now self-seeds at bring-up — it publishes the BIG
+zaaktype and wires the ACL to it, deploys the `diploma-eligibility` DMN, and registers the NRC
+abonnement — so a fresh bring-up runs submit → werkbak → openbaar without the manual seeding the
+`verify-*` scripts do for CI. (Previously the process stuck at `OpenZaakAanmaken`, the werkbak stayed
+empty, and the openbaar register showed nothing.)
+
+```bash
+# 1. Fresh bring-up (self-seeding init containers: local-seed, nrc-subscribe; DMN in flowable-init).
+make local
+
+# 2. Assert the whole flow works with no manual seeding — submit opens a zaak, documents route it to
+#    the werkbak, and the reference appears in the openbaar register:
+make verify-local     # → "OK — a fresh local stack completed the flow with no manual seeding ..."
+
+# 3. Or by hand in the browser: log in at http://localhost:8140 (jan-burger / test123), submit +
+#    upload a PDF, then approve it in the werkbak at http://localhost:8142 (merel-behandelaar /
+#    test123); it shows as INGESCHREVEN in the openbaar register at http://localhost:8141.
+```
+
+> The zaaktype UUID is server-assigned, so `local-seed` writes the real URL into a shared volume as
+> `acl.env` and the ACL sources it on startup (ADR-0020). The cleaner long-term fix — the ACL
+> resolving its zaaktype by `identificatie` — is tracked separately as S-27 (#113).
+
+---
+
 ## S-08d — Walking skeleton complete: browser → submit, end-to-end
 
 **Outcome:** the self-service portal is served in the stack and the full front-of-house happy path