A cert-manager CA injector updates one namespace and misses another

The CA bundle refresh works in part of the cluster, yet one webhook object is no longer selected by the injector after a label schema change.