A Gatekeeper constraint rejects only one object kind

Most objects are validated with the new template, yet one kind still flows through a stale schema path on one control-plane node.