ValidatingAdmissionPolicy denies updates

New objects pass validation, but updates to older resources fail because the rule does not guard for legacy schemas missing the referenced field.