cmd/

Command access-vw-init installs the kcp-side objects the access virtual workspace needs — the APIResourceSchema, the APIExport, and the APIExportEndpointSlice the RBAC provider follows — and verifies they came up.

Command scar-to-kubeconfig calls the SCAR endpoint with a bearer token and writes a kubeconfig with one context per authorized cluster.