A meta `Package` that respects its sub-`Package`s's paused field

meta-package.yaml

---
apiVersion: kapp.k14s.io/v1alpha1
kind: Config
rebaseRules:
  - path: [spec, paused]
    type: copy
    sources: [existing, new]
    resourceMatchers:
      - andMatcher:
          matchers:
            - apiVersionKindMatcher:
                {
                  apiVersion: packaging.carvel.dev/v1alpha1,
                  kind: PackageInstall,
                }

---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: install-sa

---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: install-cluster-admin-role
rules:
  - apiGroups:
      - "*"
    resources:
      - "*"
    verbs:
      - "*"

---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: install-cluster-admin-role-binding
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: install-cluster-admin-role
subjects:
  - kind: ServiceAccount
    name: install-sa
    namespace: default

---
apiVersion: data.packaging.carvel.dev/v1alpha1
kind: Package
metadata:
  name: test.example.com.0.1.0
spec:
  refName: test.example.com
  version: 0.1.0
  template:
    spec:
      deploy:
        - kapp: {}
      fetch:
        - path: config
          inline:
            paths:
              config/config.yaml: |
                #@ load("@ytt:data", "data")
                ---
                apiVersion: v1
                kind: ConfigMap
                metadata:
                  name: test.example.com
                  namespace: default
      template:
        - ytt:
            paths:
              - ./config

---
apiVersion: packaging.carvel.dev/v1alpha1
kind: PackageInstall
metadata:
  name: test
  namespace: default
spec:
  packageRef:
    refName: test.example.com
    versionSelection:
      constraints: "> 0.0.0"
  serviceAccountName: install-sa
  syncPeriod: 10s