The OTE testing that an invalid watch namespace is rejected in the single/own namespace story is failing around here when Boxcutter is on. I think that in the Helm implementation this error is terminal and the Installed/False/Failed condition is placed, which is not happening in the Helm applier implementation. We should update the Boxcutter implementation to harmonize with the current behavior.