Fills the gap blocking a PDS from implementing real PLC handle updates (only genesis operations were previously supported end-to-end): - wf_plc_get_last_op fetches an account's currently published operation from the PLC directory (GET {plc_directory_url}/{did}/log/last) and computes its CID via the same canonical-CBOR path wf_plc_operation_compute_did already uses -- the value a caller must set as `prev` on the next operation. - wf_plc_build_handle_update wraps it for the common case: change only alsoKnownAs to the new handle, preserving rotationKeys, verificationMethods, and services from the current operation unchanged, then sign with the caller-supplied rotation key. Every PLC operation is a full snapshot, not a diff, so getting this merge wrong corrupts a live account's DID document. Both take a caller-owned wf_xrpc_client so tests can install wf_xrpc_set_handler and run offline, unlike wf_plc_submit_operation_raw's self-contained-client pattern.