ci(domain): containerize, wire into compose, and verify end-to-end (refs #6)

Dockerfile (multi-stage, .NET 10) + .dockerignore for the BIG Domain Service; a
'domain' service in infra/docker-compose.yml (health-checked, depends on acl healthy
and flowable-init completed). run-domain-check.sh drives the full path against the up
stack — seed a published zaaktype, recreate the acl pointed at it (host-consistent),
POST /registrations, and assert the worker opens a zaak and records it. Wired as the
verify-domain Makefile target + a verify-stack CI step; domain added to WAIT_SVCS and
the log dump. seed_catalogus.py now emits a machine-readable ZAAKTYPE_URL line.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

infra/openzaak/seed_catalogus.py

@@ -210,6 +210,10 @@ def main():
     print(f"zaaktypen in BIG: {names}")
     assert "BIG-REGISTRATIE" in names, "BIG-REGISTRATIE not listed"
     state = "published" if PUBLISH else "concept"
+    # Machine-readable line so callers (e.g. infra/run-domain-check.sh) can capture the
+    # zaaktype URL to configure the ACL's default-fill (ADR-0003/0009).
+    zt_url = next(z["url"] for z in zaaktypen if z.get("identificatie") == "BIG-REGISTRATIE")
+    print(f"ZAAKTYPE_URL {zt_url}")
     print(f"OK — BIG catalogus seeded (BIG-REGISTRATIE {state} + bsn eigenschap)")