fix: migrate renamed channels in place

[heimanba]

What changed

• Detect unambiguous Channel YAML-key renames and plan them as in-place updates.
• Retain the existing remote Channel ID and migrate the local state address only after the update succeeds.
• Store a non-reversible credential fingerprint to disambiguate future Channel renames without persisting credentials.
• Preserve old Identity/Template dependencies when a Channel migration fails.
• Report Qoder CHANNEL_CREDENTIAL_CONFLICT as credential ownership instead of a stale-name conflict.
• Update the generated OpenAPI contract for the rename metadata.

Why

Qoder allows a DingTalk credential set to belong to only one Channel. The previous create-before-delete plan attempted to create the renamed Channel while the old Channel still owned those credentials, causing CHANNEL_CREDENTIAL_CONFLICT. Users then had to run apply twice or manually manipulate state.

After this change, a safe rename is transparent: users edit agents.yaml and run agents apply; the existing remote Channel is updated in place.

Safety

Rename inference is conservative. It requires a unique same-provider, same-type match, using the stored credential fingerprint when available. Ambiguous plans retain the existing create/delete behavior rather than guessing. If the in-place update fails, deletion of the old referenced Identity or Template is skipped.

Validation

• SDK test suite: 649 passed
• Scoped verification: passed
• OpenAPI contract tests: 2 passed
• Full push verification profile: typecheck, architecture checks, and repository tests completed
• git diff --check: passed