Treat group member field referenceName as exact identity

[bwl21]

Problem

Group member field referenceName is identity-bearing because dynamic group rulesets address fields by that exact string. ct-cli currently normalizes values such as hyphens and underscores to the same logical slug. This can hide a real identity mismatch:

• intended/API reference name: stand-bewerbung
• actual/API reference name: stand_bewerbung
• ruleset target: stand-bewerbung

The plan can report convergence even though the ruleset targets a different field reference name.

Observed with:

ct 3.7.0-dev.16+f2c8724

Reproduction

A blueprint originally kept the local key separate from the exact ChurchTools identity:

{
  key: "stand_bewerbung",
  referenceName: "stand-bewerbung",
  name: "Stand",
  fieldTypeCode: "select",
}

After the explicit referenceName was removed/reconciled, the managed field used stand_bewerbung, while the dynamic ruleset still contained:

{
  "groupMemberFields": {
    "stand-bewerbung": "❓Offen"
  }
}

Using a blueprint key containing a hyphen does not reliably protect the API identity, because the logical key/state representation is normalized. A subsequent plan does not surface the stand-bewerbung versus stand_bewerbung mismatch.

The same issue affects values such as:

• praktikum-1 vs. praktikum_1
• naechster-schritt vs. naechster_schritt

Expected behavior

1. Compare ChurchTools member-field referenceName exactly; do not treat - and _ as equivalent.
2. Preserve an explicitly configured referenceName on create.
3. Keep the local ct-cli key separate from the ChurchTools referenceName.
4. Surface an existing exact mismatch prominently in plan.
5. Because referenceName is identity-bearing and rulesets depend on it, do not silently rename it during update. If ChurchTools cannot safely rename it, fail with an actionable diagnostic or model it as an explicit replacement.
6. Add a regression test where the local key is stand_bewerbung, the configured reference name is stand-bewerbung, and the ruleset uses stand-bewerbung.

Impact

The mismatch can leave an applied configuration looking converged while automatic membership rules write to a non-existent member-field reference. Recovery may require manually deleting and recreating otherwise empty groups.