Exclude Namespaces Without Creating a Gatekeeper Bypass

Exclude Kubernetes namespaces at the right Gatekeeper layer while preventing ordinary namespace editors from granting themselves a policy bypass.