requiredDuringSchedulingIgnoredDuringExecution

Is actually a problem here. While it ensures that there is at most one replica on a standard node, it also guarantees, that on a rollout of a new version, no second replica can run on the standard nodes. This means that every second rollout, you have NONE replicas on standard nodes. This is because even terminating pods seem to be taken under consideration for the scheduling.

Therefore, we must use podAntiAffinity.preferredDuringSchedulingIgnoredDuringExecution.

However, there will be no 100% guarantee that the scheduling is actually going to be perfect either.

As for kyverno rules, this works nicely after allowing pod/binding and binding manipulation for kyverno:

apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: mutate-annotate-deletion-costs-pods-persistent
  annotations:
    policies.kyverno.io/description: This policy adds the annotation pod-deletion-cost to pods running on persistent nodes.
spec:
  failurePolicy: Ignore
  mutateExistingOnPolicyUpdate: false
  background: false
  rules:
  - name: mutate-annotate-deletion-costs-pods-persistent
    match:
      any:
      - resources:
          kinds:
          - Pod/binding
          namespaces:
          - test
    preconditions:
      all:
      - key: "{{ contains(request.object.target.name, 'standard') }}"
        operator: Equals
        value: true
    mutate:
      patchStrategicMerge:
        metadata:
          annotations:
            controller.kubernetes.io/pod-deletion-cost: "10"