Fail ci matrix on empty --image-version filter and cover it

Per review feedback on #480:

- When --image-version is set and matches nothing, exit non-zero
  instead of emitting "[]". In CI, a silent empty matrix skips all
  build jobs while the workflow reports green, masking a dispatch
  that targeted a nonexistent version.
- Add feature scenarios for matching and non-matching filters.

Author: bschwedler

posit-bakery/posit_bakery/cli/ci.py

@@ -143,8 +143,14 @@ def matrix(
                 else:
                     data.append(entry.copy())
 
+        if image_version is not None and not data:
+            log.error(f"No matrix entries matched --image-version '{image_version}'")
+            raise typer.Exit(code=1)
+
         stdout_console.print(json.dumps(data))
 
+    except typer.Exit:
+        raise
     except:
         log.exception("Failed to load bakery config")
         raise typer.Exit(code=1)

posit-bakery/test/cli/testdata/ci/matrix/basic/image_version_match.json

@@ -0,0 +1 @@
+[{"image": "test-image", "version": "1.0.0", "dev": false, "platform": "linux/amd64"}]

posit-bakery/test/features/cli/ci/matrix.feature

@@ -30,3 +30,20 @@ Feature: matrix
         When I execute the command
         Then The command succeeds
         * the matrix matches testdata ci/matrix/multiplatform/exclude_platform.json
+
+    Scenario: Filtering the CI matrix to a matching image version
+        Given I call bakery ci matrix
+        * in the basic context
+        * with the arguments:
+            | --image-version | 1.0.0 |
+        When I execute the command
+        Then The command succeeds
+        * the matrix matches testdata ci/matrix/basic/image_version_match.json
+
+    Scenario: Filtering the CI matrix to an unknown image version fails loudly
+        Given I call bakery ci matrix
+        * in the basic context
+        * with the arguments:
+            | --image-version | 9.9.9 |
+        When I execute the command
+        Then The command fails