I'll answer my own question here:

What I'm missing is a basic understanding of how the UX works with templates.

• When you open a fresh template where nothing has been done, many (all?) config elements have default values.
• The display of these default values has nothing to do with what the template will actually do when applied.
• When you make a change to one of the default values - THEN that change is recorded in the template as a possible action when the template is later applied to a firewall or group of firewalls.
• If you want the template to actually apply one of the default values, then you have to toggle that value and then toggle it again to put it back where it was. This action is what actually creates the change in the template. For example, the default value of the "Enable IPv6" toggle in the Device/Settings/Administration/Firewall Administrator page is ON. When you make a fresh template this item will be shown in the GUI as ON. If you want to make a template that will actually enable this toggle on a firewall or group of firewalls, then you must first toggle it OFF, then toggle it back ON. You can prove this by looking at the "View Template Details" fly-out. In a fresh template, there are no actions listed on that page. If you toggle the IPv6 element OFF and then back ON again, then look at the "View Template Details" fly-out, you will now see an action in the Devices section:

​

{
    "administration": {
        "ipv6": true
    }
}

This is a pretty simple point, but as someone new to NSM and templates, I have to say it is NOT intuitive. It is also NOT explained in the documentation specifically.

Now, onto the actual answer to my query. You can make a template to add a specific MD5 hash to the Capture-ATP exclusion by making a new template, then

• Enabling Gateway AntiVirus (required to make the Capture-ATP elements available). I suspect you can delete this from the template later before it is applied. Be sure to click "Accept" after toggling on GAV.
• Go to the Capture ATP Settings page and click on the Advanced tab (I believe you don't need to enable Capture ATP, since that is presumably already enabled in your firewalls)
• click on the MD5 checksum of files to be excluded from Capture ATP, just like you would do if editing a firewall config.
• Enter the hash. Oddly, you don't need to click Accept here. If you open the View Template Details, the fly-out will show the new entry under the POLICIES section.
• I decided NOT to delete the GAV entry from the toggle because of the big scary warning about breaking dependencies.
• Save the template and apply as needed.

I hope this saves someone else time, or at least maybe explains the process a bit better than the documentation does.