bug: WatchList breaks restarting a kcp instance with an initialized etcd storage

[ntnn]

Describe the bug

When restarting a kcp instance with WatchList enabled kcp fails to finish bootstrapping.
The error is a bit opaque but effectively the shard resource is missing because the APIBindings are missing, which bind the kcp APIs into the root workspace. That prevents the bootstrap from finishing and kcp never becoming ready.

• Fix the WatchList error
• Add a test verifying that kcp being restarted with the same etcd storage still works

For the test I think the integration tests can be used, they allow explicitly stopping and starting the kcp server.

Steps To Reproduce

1. Revert Disable WatchList feature gate #3917
2. Start kcp
3. Stop kcp
4. Start kcp again with the same .kcp
5. Run: kubectl ws tree ; kubectl get shards ; kubectl get apibindings.apis.kcp.io

ws tree should work, get shards will fail (because the shards API is missing) and get apibindings will return nothing.

Expected Behaviour

1. Revert Disable WatchList feature gate #3917
2. Start kcp
3. Stop kcp
4. Start kcp again with the same .kcp
5. Run: kubectl ws tree ; kubectl get shards ; kubectl get apibindings.apis.kcp.io

>k ws tree ; k get shards ; k get apibindings.apis.kcp.io
.
└── root

NAME   REGION   URL                      EXTERNAL URL             AGE
root            https://127.0.0.1:6443   https://127.0.0.1:6443   61s
NAME                 AGE   READY
shards.core.kcp.io   71s   True
tenancy.kcp.io       71s   True
topology.kcp.io      71s   True

Additional Context

No response