A validating admission policy allows creates and blocks updates

The same resource shape is accepted once and rejected later due to one deterministic-looking comparison that is not actually stable. Normal traffic masked the issue until the standby or alternate path became active under rehearsal conditions.