fix: make credential create --update match existing credentials without canonical

[fhacloid]

Summary

• fix credential create <type> --update when users only provide --name (no explicit --canonical)
• make the update detection lookup robust by matching existing credentials in this order:
  1. canonical
  2. path
  3. name
• when an existing credential is found by path/name, resolve and inject its canonical before delegating to credential update
• add focused unit tests for path defaulting and matching precedence

Root cause

create --update only checked existing credentials by canonical equality. In common flows (--name only), canonical is empty at CLI level, so the match failed and the command still called create, returning a 409 conflict on path.

Testing

Attempted in this environment:

• make format ❌ (blocked: Go 1.25 toolchain unavailable; gci missing)
• go test ./cmd/cycloid/credentials/... ❌ (blocked: Go 1.25 toolchain unavailable)
• make lint ❌ (blocked: Go 1.25 toolchain unavailable; golangci-lint missing)

Added automated coverage in:

• cmd/cycloid/credentials/create_test.go

Linear Issue: CLI-104