data.kv wipes all package secrets when no operation matches

When a `BundlePatch` rule contains `package.data.kv` but none of the `kv` operations produces a result, `harp` silently replaces the matched package's secrets with an empty set instead of leaving them untouched.

## empty kv block

```sh
# 1. Build a single-package bundle
echo '{"app/target":{"k":"v","k2":"v2"}}' | harp from jsonmap > in.bundle

# 2. Patch spec: an empty kv block
cat > empty-kv.yaml <<'EOF'
apiVersion: harp.elastic.co/v1
kind: BundlePatch
meta:
name: empty-kv
spec:
rules:
- selector:
matchPath:
regex: "^app/"
package:
data:
kv: {}
EOF

# 3. Apply and observe
harp bundle patch --in in.bundle --spec empty-kv.yaml > out.bundle
harp bundle dump --in out.bundle --data-only
```

**Actual behavior**
`{"app/target":{}}` ← both secrets are gone

**Expected behavior**
`{"app/target":{"k":"v","k2":"v2"}}`

## removeKeys that matches no key

```sh
# 1. Build a 2-package bundle (sorted: aaa < bbb).
# app/aaa has no `tmp_` key; app/bbb has one.
cat > input.json <<'EOF'
{
"app/aaa": {"real_key": "should-survive"},
"app/bbb": {"tmp_key": "v1", "keep": "keep-this"}
}
EOF
harp from jsonmap --in input.json > in.bundle

# 2. Patch spec: drop every `tmp_` prefixed key from every package
cat > remove-tmp.yaml <<'EOF'
apiVersion: harp.elastic.co/v1
kind: BundlePatch
meta:
name: remove-tmp
spec:
rules:
- selector:
matchPath:
regex: "^app/"
package:
data:
kv:
removeKeys:
- "^tmp_"
EOF

# 3. Apply and observe
harp bundle patch --in in.bundle --spec remove-tmp.yaml > out.bundle
harp bundle dump --in out.bundle --data-only
```

**Actual behavior**
`{"app/aaa":{},"app/bbb":{"keep":"keep-this"}}`

- `app/aaa` has no `tmp_` key, so nothing should have been removed from it, but it lost `real_key`.
- `app/bbb`, where `removeKeys` did match, is patched correctly.

i.e. The wipe only hits the packages a `removeKeys` rule was never meant to touch.

**Expected behavior**
`{"app/aaa":{"real_key":"should-survive"},"app/bbb":{"keep":"keep-this"}}`

---

Version:
`0.2.12 [main:2025-04-30T22:12:09Z] (Go: go1.23.8 linux/amd64, Flags: defaults, Date: 2025-04-30T22:28:01Z)`

Start by running the provided `harp bundle patch` reproductions for an empty `kv` block and a non-matching `removeKeys` rule. Trace the `BundlePatch` handling behind the `harp bundle patch` entry point, then verify that unmatched packages retain their existing secrets while packages with matching operations are still patched.

Written by the indexing model from the issue text.