fix(target-update): compare a hashed-at-rest credential ref by identity