feat(infra): subscribe the projection to the objecten kanaal (refs #153)

Completes the re-source (ADR-0030): the Event Subscriber's abonnement moves from `zaken` to
`objecten`, in both the local stack's `nrc-subscribe` and the CI projection check. The
OpenZaak → NRC check keeps its own `zaken` abonnement — OpenZaak still publishes, nothing
in the product listens.

- register-abonnement.py subscribes to `objecten`, and now treats the kanaal as part of
  "already current" — an abonnement left from before this slice points at the right callback
  but the wrong kanaal, and would never have been replaced on IP alone.
- run-projection-check.sh opens its zaak *through the ACL* instead of straight against
  OpenZaak, because the ACL is what writes the register record the projection is now derived
  from. A zaak created behind the ACL's back produces no row — which is the re-source working.
- The acceptance scenario is restated in register terms and gains the approval case: the same
  row moving INGEDIEND → INGESCHREVEN is now one registration's record being updated, not two
  unrelated ZGW events.

tests/acceptance/Support/InMemoryProjectionStores.cs

@@ -39,10 +39,12 @@ public sealed class InMemoryProjectionStore : IProjectionStore
         => [.. _byId.Values.Where(e => e.Id == id)];
 }
 
-/// <summary>A fake ACL client for the projection acceptance scenario: returns a reference derived
-/// from the zaak, so the projector can enrich rows without a running ACL (#78).</summary>
-public sealed class InMemoryAclReferenceClient : IAclClient
+/// <summary>An in-memory stand-in for the register the ACL reads back for the projector, so the
+/// scenario runs without a running ACL or Objecten (S-19b-2, ADR-0030).</summary>
+public sealed class InMemoryRegisterRecordClient : IAclClient
 {
-    public Task<string> GetZaakReferenceAsync(Uri zaakUrl, CancellationToken ct = default)
-        => Task.FromResult("REG-" + zaakUrl.Segments[^1].Trim('/'));
+    public Dictionary<string, RegisterRecord> Records { get; } = [];
+
+    public Task<RegisterRecord?> GetRegisterRecordAsync(Uri objectUrl, CancellationToken ct = default)
+        => Task.FromResult(Records.TryGetValue(objectUrl.ToString(), out var record) ? record : null);
 }