fix(patch,resource-update): empty values survive hinted fields and unresolved reference adds plan

[JeroenSoeters]

Summary

Two defects with one representational root cause: the property pipeline treats empty values as rendering noise and filters them, destroying values that are deliberate.

• An opaque document field (e.g. a Kubernetes custom resource spec where selfSigned: {} IS the declaration) reached providers with its empty members recursively stripped, from the create payload, the diff inputs, and patch op values - valid objects were rejected by admission and the recursive collapse defeated workarounds.
• Adding a NEW reference field to an existing resource planned nothing when the reference could not resolve at plan time: the unresolved envelope flattens to an empty string, the top-level empty-value filter drops it as noise, and the whole update is silently discarded before execution-time resolution can run.

Mechanism

• A new opt-in schema hint, preserveEmptyValues, marks a top-level field's subtree as carrying meaningful empty collections. Every empty-collection normalization skips such subtrees: both diff inputs, post-diff op values, the spurious-add filter, and the plugin-bound property conversion (all contexts: write, Read, sync, delete). The persist merge keeps empty objects and arrays under such roots. Matching is by first RFC 6901 pointer segment against a root set derived from schema hints; dotted (nested subresource) hints grant nothing. The absence-scoped provider-echo tolerance is unchanged, empty strings gain no exemption, and Atomic keeps exactly its existing diff-granularity meaning - existing plugin schemas see no behavior change, pinned by tests.
• The top-level empty-value drop's keep-set widens to fields whose desired pre-flatten value is a well-formed reference envelope (strict predicate: a $ref with a parseable identity, or a complete $res declaration). A first-declared unresolvable reference now plans a placeholder op that execution resolves live; only the placeholder ever persists. CreateOnly destinations are excluded: a replacement is never planned from a value that has not resolved.

Tests

Unit pins for every touched site (fidelity at each strip, defaults preserved for unhinted fields, path matcher prefix/escape cases, envelope predicate matrix, churn contract, no-change guarantees) and workflow acceptance: an opaque-bodied resource creates verbatim, re-applies clean, and updates as one whole value still carrying its empty member; an existing resource gaining a reference to a hashed secret plans, delivers the resolved value together with an ordinary sibling change, re-applies clean, and persists no plaintext.

A follow-up in the kubernetes plugin opts K8S::Custom::Resource.spec in with updateMethod = "Atomic" + preserveEmptyValues = true and a minFormaeVersion bump.