ci(domain): containerize, wire into compose, and verify end-to-end (refs #6)

Dockerfile (multi-stage, .NET 10) + .dockerignore for the BIG Domain Service; a
'domain' service in infra/docker-compose.yml (health-checked, depends on acl healthy
and flowable-init completed). run-domain-check.sh drives the full path against the up
stack — seed a published zaaktype, recreate the acl pointed at it (host-consistent),
POST /registrations, and assert the worker opens a zaak and records it. Wired as the
verify-domain Makefile target + a verify-stack CI step; domain added to WAIT_SVCS and
the log dump. seed_catalogus.py now emits a machine-readable ZAAKTYPE_URL line.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

infra/docker-compose.yml

@@ -285,7 +285,9 @@ services:
       dockerfile: Dockerfile
     image: register-referentie/acl:dev
     environment:
-      Acl__OpenZaak__BaseUrl: http://openzaak:8000/
+      # Overridable so verify-domain can point the ACL at the same OpenZaak host that
+      # owns the seeded zaaktype URL (host-consistent zaak creation, ADR-0009).
+      Acl__OpenZaak__BaseUrl: ${ACL_OPENZAAK_BASEURL:-http://openzaak:8000/}
       Acl__OpenZaak__ClientId: big-reference-seed
       Acl__OpenZaak__Secret: insecure-dev-secret-change-me
       Acl__Defaults__Bronorganisatie: "517439943"
@@ -306,6 +308,36 @@ services:
         condition: service_healthy
     networks: [cg]
 
+  # ── BIG Domain Service (S-05) ──────────────────────────────────────────────
+  # Orchestrates a registration: POST /registrations creates the aggregate and
+  # starts the registratie Flowable process; a hosted worker acquires the
+  # OpenZaakAanmaken job, opens a zaak via the ACL and completes it (ADR-0009).
+  # Talks only to Flowable (Workflow Client, §8.2) and the ACL (§8.1).
+  domain:
+    build:
+      context: ../services/domain
+      dockerfile: Dockerfile
+    image: register-referentie/domain:dev
+    environment:
+      Flowable__BaseUrl: http://flowable-rest:8080/flowable-rest/
+      Flowable__Username: rest-admin
+      Flowable__Password: test
+      Acl__BaseUrl: http://acl:8080/
+    ports:
+      - "8130:8080"
+    healthcheck:
+      test: ["CMD", "curl", "-fsS", "http://localhost:8080/health"]
+      interval: 5s
+      timeout: 3s
+      retries: 5
+      start_period: 10s
+    depends_on:
+      acl:
+        condition: service_healthy
+      flowable-init:
+        condition: service_completed_successfully
+    networks: [cg]
+
   # ── BFF ──────────────────────────────────────────────────────────────────
   bff:
     build: