updateDID discards all verification relationships when verificationMethods is supplied

In `prepareUpdateEntry` (`src/core/entries.ts`), supplying `verificationMethods` overwrites all six derived properties from a fresh `createDIDDoc`:

```ts
if (safeVerificationMethods !== undefined) {
doc.verificationMethod = normalizedUpdateDoc.verificationMethod;
doc.authentication = normalizedUpdateDoc.authentication;
doc.assertionMethod = normalizedUpdateDoc.assertionMethod;
// ... keyAgreement, capabilityDelegation, capabilityInvocation
}
```

`normalizeVMs` only populates a relationship when `vm.purpose` is set, so an update that passes the current `verificationMethod` array straight through — a natural way to change only `service` — silently drops every relationship the DID had, unless the caller also re-passes `authentication` / `assertionMethod` / `keyAgreement`.

On `main` this is broader than in 2.8.0: `normalizeVMs` used to default purpose-less methods into `authentication`, so that one survived. Now none do, and the DID resolves to a document whose keys are authorized for nothing.

We hit this in credo-ts and work around it by re-reading the relationships from the last log state: openwallet-foundation/credo-ts#2928

Suggestion: merge rather than replace — only reset the relationships the caller actually supplies.