bug: wildcard watch on apiexport virtual workspace fails with 'Too large resource version' #4497

Describe the bug

Watch requests on the APIExport virtual workspace wildcard path (/services/apiexport/<export>/clusters/*/<resource>?watch=true) immediately fail with:

Too large resource version: <list RV>, current: <watch cache RV>  (HTTP 504)

The client's informer then spins in a retry loop without ever receiving events. Sync agents effectively only get data from the initial LIST; afterwards no watch events are delivered — objects change on the fly unnoticed.

To Reproduce

1. Run kcp v0.33.1 with an APIExport virtual workspace.
2. With agent credentials: kubectl get --raw "<VW-url>/clusters/*/<resource>?watch=true" → immediate Too large resource version error.
3. The same LIST (without watch=true) succeeds and returns a resource version ahead of the VW watch cache; the delta never closes.
4. Observed with api-syncagent v0.7.0 as the client: it only picks up changes after a restart (fresh LIST).

Expected behavior

Wildcard watch on the virtual workspace delivers events; the VW watch cache catches up to the LIST resource version.

Additional context

• Diagnosis from our side: LIST returns the RV from etcd, while the VW watch cache lags behind by a persistent delta. Restarting the shard and the agents does not help.
• Seen in production: kcp v0.33.1, api-syncagent v0.7.0, wildcard VW of a platform APIExport.

/kind bug