Wake Approvisionnement on a stock event instead of a clock

The reactive half of the agent. It consumes product.stock_changed from the
catalog topic and reports only a crossing of the threshold — every further
order line on an already-low reference would otherwise raise the same alarm,
and an agent that repeats itself is one a human learns to ignore. A stock-out
is treated as its own fact even when the reference was already low.

The detection lands on a watchlist readable over a webhook, because a proposal
that reached only an execution log would be lost between two nightly runs.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

CLAUDE.md

@@ -176,3 +176,26 @@ endpoints and the known blockers.
 
 Deliverables in English. Export workflows as JSON and commit them; do not rely
 on the n8n instance as the source of truth.
+
+## The Kafka credential is created by hand
+
+`kafka-classic-models` in n8n holds the SCRAM password of the
+`classic-models-agent-approvisionnement` KafkaUser and the Strimzi cluster CA.
+It is not in this repo and must not be: n8n encrypts stored credentials with
+`N8N_ENCRYPTION_KEY`, and the committed workflow JSON references it by id only.
+
+To recreate it after a rebuild:
+
+```
+kubectl -n kafka get secret classic-models-agent-approvisionnement \
+  -o jsonpath='{.data.password}' | base64 -d
+kubectl -n kafka get secret kafka-cluster-ca-cert \
+  -o jsonpath='{.data.ca\.crt}' | base64 -d
+```
+
+then POST to `/rest/credentials` with type `kafka`, `ssl: true`, the CA in the
+`ca` field, `saslMechanism: scram-sha-512`, brokers
+`kafka-kafka-bootstrap.kafka.svc.cluster.local:9093`. The workflow's
+`credentials.kafka.id` then needs the new id.
+
+The KafkaUser itself lives in `infra-kafka/kafka-users.yaml`.