fix(cli): read commander's camelCase keys for kebab-case flags

commander stores --code-file as opts.codeFile (kebab keys are never set),
so 'action update --code-file' silently no-opped (workflow.ts read
opts['code-file']) and 'auth token create --base-ids/--full-access'
never applied (auth.ts read the kebab keys). The 'action add' path was
unaffected because buildActionConfig's pick() checks both forms.

- workflow.ts action update: opts['code-file'] ?? opts.codeFile
- auth.ts token create: baseIds/fullAccess dual-form read
- verified live: action update --code-file now persists the new script
  (was silently keeping old code); commander dual-key behavior confirmed
  by direct parse (kebab keys absent, camelCase present, and this
  commander version drops the --base-ids VALUE entirely — the dual read
  covers both)

dist/commands/workflow.js

@@ -463,8 +463,11 @@ function actionCommand() {
         else {
             // Granular update: merge only the flags the user actually passed.
             config = { ...config };
-            if (opts.code !== undefined || opts['code-file'] !== undefined) {
-                config.code = opts['code-file'] ? readFile(opts['code-file']) : opts.code;
+            // commander stores --kebab-case flags camelCased (--code-file ->
+            // opts.codeFile); accept both forms like buildActionConfig's pick().
+            const codeFile = opts['code-file'] ?? opts.codeFile;
+            if (opts.code !== undefined || codeFile !== undefined) {
+                config.code = codeFile ? readFile(codeFile) : opts.code;
             }
             if (opts.timeout !== undefined)
                 config.timeout = Number(opts.timeout);