Summary

Enables kube-bind to serve resources in a 3-tier kcp topology where the backend workspace has no APIExport of its own — only an APIBinding that binds from an upstream provider workspace.

Problem

Standard kube-bind + kcp is 2-tier: :root:provider owns the APIExport, consumer binds via kube-bind. This PR adds a 3-tier model:

:root:provider   — owns APIResourceSchema + APIExport
      |  (APIBinding)
      v
:root:backend    — binds from provider; kube-bind backend runs here
      |  (kube-bind serving)
      v
  consumer       — binds resources via kube-bind

The backend has no APIExport — previously, this made it impossible to serve resources since kube-bind needs local APIServiceExportTemplate and APIResourceSchema copies.

What this adds

Two new kcp-specific controllers (only active with --provider=kcp):

apibindingtemplate controller — watches APIBinding objects; when Bound, auto-creates APIServiceExportTemplate objects (one per scope) derived from the bound resources; binding is owner so templates GC on removal
apiresourceschema controller — watches APIServiceExportTemplate; copies APIResourceSchema definitions from the bound APIBinding into the backend workspace labeled kube-bind.io/exported=true for ServiceExportRequest discovery

Bootstrap also gains apibindings + subjectaccessreviews permission claims required by the new controllers.

Tests
kcp_3tier_test.go — two e2e tests covering cluster-scoped and namespaced resources through the full provider → backend → consumer chain.

What Type of PR Is This?

/kind feature

Related Issue(s)

Fixes #

Release Notes

kcp provider: add 3-tier topology support — backend can now serve resources from workspaces with only an APIBinding (no APIExport required). New apibindingtemplate and apiresourceschema controllers auto-populate templates and schema copies.