bug: kubectl kcp bind apiexport --accept-all-permission-claims drops the identity hash of claims #4544

Describe the bug

kubectl kcp bind apiexport --accept-all-permission-claims (and --reject-all-permission-claims) reads the permission claims from the APIExport and copies only the group and resource into the APIBinding. The identityHash of each claim is dropped.

Claims on built-in resources have no identity hash, so they work. A claim on a resource from another APIExport always carries an identity hash (APIExport admission enforces this). For such a claim, the accepted claim in the APIBinding has an empty identity hash and does not match the exported claim. The permission claim label controller keys claims by resource, group and identity hash, so it treats the accepted claim as unexpected and never applies the exported claim. The command still prints <name> created and bound.

Steps to reproduce

1. In a provider workspace, create an APIExport whose permissionClaims include a resource from another APIExport, with its identityHash.
2. In a consumer workspace that can bind that API, run kubectl kcp bind apiexport <path>:<export> --accept-all-permission-claims.
3. Run kubectl get apibinding <export> -o yaml.

Expected behavior

spec.permissionClaims contains the claim with the same identityHash as the APIExport, and the claim is applied.

Actual behavior

spec.permissionClaims contains the claim without identityHash. The claim is reported as unexpected or invalid in the APIBinding conditions, and the exported claim stays unaccepted.

Additional context

The loop in staging/src/github.com/kcp-dev/cli/pkg/bind/plugin/bind.go (Run) builds the AcceptablePermissionClaim without setting IdentityHash. The feature was added in #3946.