fix(infra): address Objecten by a dotted host so NRC accepts its notifications (refs #152)

The worker published and NRC answered 400 on every message:

  {"hoofdObject":["Voer een geldige URL in."],"resourceUrl":["Voer een geldige URL in."]}

NRC types both as DRF `URLField`, and Django's URLValidator refuses a single-label host.
Objecten fills them from the object `url` DRF built with `request.build_absolute_uri` —
the Host the *caller* used — so `SITE_DOMAIN` never entered into it. Dropped that env pair;
it was a wrong guess at the mechanism.

The fix is on the caller side: keep the `objecten.local` network alias and point every
writer whose writes must be notified at it — the ACL, the gateway integration tests, and
this slice's verify driver. Readers keep the plain service name.

ADR-0029 updated with the real mechanism and the ceiling it leaves: a new writer using
`objecten:8000` gets a 201 and silently no notification.

infra/run-objecten-notifications-check.sh

@@ -11,9 +11,10 @@
 #
 # All in-network, reaching services by container IP (a single-label host isn't URL-valid for NRC's
 # callbackUrl validator; the runner can't reach published ports — gitea-actions-gotchas.md §5/§6).
-# EXCEPT Objecten/Objecttypen, which must be reached by SERVICE NAME: Objecttypen echoes the request
-# Host into the objecttype `url` and Objecten only accepts the one matching its configured api_root
-# (ADR-0028).
+# EXCEPT Objecttypen, which must be reached by SERVICE NAME: it echoes the request Host into the
+# objecttype `url` and Objecten only accepts the one matching its configured api_root (ADR-0028);
+# and Objecten, reached by its `objecten.local` alias because it reflects the request Host into the
+# notification's hoofdObject/resourceUrl, which NRC validates as a URL (ADR-0029).
 #
 # Does NOT manage the stack lifecycle, but cleans up the sink/driver it creates.
 set -euo pipefail
@@ -48,7 +49,7 @@ echo ">> sink at $sink_ip:9000"
 echo ">> registering the abonnement + writing a RegisterRecord"
 docker rm -f rr-overify >/dev/null 2>&1 || true
 drv="$(docker create --network "$net" --name rr-overify \
-  -e "OBJECTEN=http://objecten:8000" \
+  -e "OBJECTEN=http://objecten.local:8000" \
   -e "OBJECTEN_TOKEN=${OBJECTEN_TOKEN:-1234567890abcdef1234567890abcdef12345678}" \
   -e "OBJECTTYPEN=http://objecttypen:8000" \
   -e "OBJECTTYPEN_TOKEN=${OBJECTTYPEN_TOKEN:-0123456789abcdef0123456789abcdef01234567}" \