DeziUserCredential credentialSubject emits wrong @type

On branch project-gf, CreateDeziUserCredential (in vcr/credential/dezi.go) produces a credentialSubject whose @type is DeziIDTokenSubject. Per the DeziUserCredential specification (NL Generic Functions IG, credential-DeziUserCredential.md), the credentialSubject.@type must be HealthcareProvider — the type describes the role of the subject, not the carrier.

The relevant code:

func (d DeziIDTokenSubject) MarshalJSON() ([]byte, error) {
    type Alias DeziIDTokenSubject
    aux := struct {
        Alias
        Type string `json:"@type"`
    }{
        Alias: Alias(d),
        Type:  "DeziIDTokenSubject",
    }
    return json.Marshal(aux)
}

The @type literal should be "HealthcareProvider". The inner Employee (HealthcareWorker) @type is already correct.

Expected

credentialSubject.@type == "HealthcareProvider"

Actual

credentialSubject.@type == "DeziIDTokenSubject"

Notes

• Found while aligning the IG spec with the implementation.
• Tests in dezi_test.go should be updated to assert @type once fixed.

Start in vcr/credential/dezi.go at DeziIDTokenSubject.MarshalJSON and review dezi_test.go. Change the emitted credentialSubject @type to match the DeziUserCredential specification, then update or run the tests to verify it is HealthcareProvider while the inner Employee type remains HealthcareWorker.