Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Outside diff comments:
In `@bindings/go/credentials/graph_test.go`:
- Around line 612-642: The test "recursive resolution through multiple edges
leads to successful merged resolution" currently only builds the graph; update
it to actually call ResolveTyped (the resolver used in resolve_direct.go) for
the consumer with identity type RecursionTest/path "recursive/path/abc" and
assert the merged credential fields match the new "last writer wins" semantics
(expect username "abc" and password "def"). Locate the test case in
graph_test.go, invoke ResolveTyped or the package's ResolveTyped helper for that
identity, and add assertions that the resolved credential map or struct contains
username == "abc" and password == "def" (or equivalent keys/types used by
ResolveTyped) to validate the resolution result.

---

Nitpick comments:
In `@bindings/go/credentials/resolve_direct.go`:
- Around line 51-53: Expand or add a unit test in graph_test.go to assert "last
writer wins" when resolving typed credentials: create a consumer node with
multiple incoming credential edges each supplying distinct credential values,
invoke the same resolution path used in the existing test (the code path that
sets resolved = credentials in resolve_direct.go), and assert that the returned
resolved value equals the credential from the last edge only (not a merge).
Reference the resolution code by the resolved variable assignment in
resolve_direct.go and the existing test "recursive resolution through multiple
edges leads to successful merged resolution" to locate where to augment or add
the new assertion.

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@bindings/go/credentials/resolve_direct.go`:
- Around line 86-110: mergeTyped treats DirectCredentials and other typed
credentials differently: DirectCredentials copies dc.Properties verbatim (so
empty strings override), while the non-DC branch only copies non-empty strings
and drops non-string fields. In mergeTyped, change the non-DC branch (the block
that converts to runtime.Raw, unmarshals into fields, and iterates for k,v) to
stop requiring v be a non-empty string; instead convert any non-nil v to a
string (e.g. via fmt.Sprint or equivalent) and assign merged[k] = that string
(skip the "type" key as before), allowing empty strings to override earlier
values and preserving override semantics consistent with DirectCredentials; keep
scheme.Convert, json.Unmarshal, raw, and fields logic intact.

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@bindings/go/credentials/resolve_direct.go`:
- Around line 27-32: The cache key is inconsistent: g.getCredentials(vertex.ID)
is used for lookup but the result is stored under node := identity.String(); fix
by using the same key for both operations—either change the lookup to
g.getCredentials(identity.String()) or change the stored key to vertex.ID—so
that the cache reads and writes use the identical key (update the code paths
around g.getCredentials, vertex.ID, identity.String(), and the assignment to
node in resolve_direct.go to match resolve_indirect.go's approach).