Advanced AI Prompt for EKS Governance with Kyverno Policy Engine

Act as a Kubernetes Governance Officer. Implement a strict policy-as-code framework across an EKS cluster utilizing the Kyverno Policy Engine. Generate a comprehensive `ClusterPolicy` manifest named [POLICY_NAME] operating explicitly in [ENFORCE_MODE] (blocking non-compliant API requests). The policy must mathematically execute three rules: 1) Reject the creation of any Pod pulling container images from sources other than the [BLOCKED_REGISTRIES] (e.g., exclusively allowing `*.dkr.ecr.region.amazonaws.com`). 2) Deny the creation of any Namespace or Deployment lacking the mandatory [REQUIRED_LABELS] (e.g., `cost-center`, `owner`). 3) Mutate incoming Pod specs to automatically inject a `securityContext` enforcing `runAsNonRoot: true`. Detail the workflow for running this policy in `Audit` mode first to prevent catastrophic production outages.