ECR Lifecycle Policy to exclude certain tags

Is there a way to exclude certain tags/images from a cleanup policy?

E.g. say I have a repository with images and the related SHAs for the Pull Request which triggered their creation. When these are approved for deployment to an environment the image is tagged with that environment's name, resulting in something like this:

+---------------------------------------------------------------------------+
| Image Tags      | Image URI                                               |
+---------------------------------------------------------------------------+
| sha923456       | 000000.dkr.ecr.eu-west-1.amazonaws.com/myrepo:sha923456 |
+-----------------+---------------------------------------------------------+
| sha823456, test | 000000.dkr.ecr.eu-west-1.amazonaws.com/myrepo:test      |
+-----------------+---------------------------------------------------------+
| sha723456       | 000000.dkr.ecr.eu-west-1.amazonaws.com/myrepo:sha723456 |
+-----------------+---------------------------------------------------------+
| sha623456, prod | 000000.dkr.ecr.eu-west-1.amazonaws.com/myrepo:prod      |
+-----------------+---------------------------------------------------------+
| sha523456       | 000000.dkr.ecr.eu-west-1.amazonaws.com/myrepo:sha523456 |
+-----------------+---------------------------------------------------------+

I want to ensure that what's currently deployed to any environment doesn't get deleted; so those images tagged test or prod should be kept. In addition, the SHA tags against their images should be kept.

Beyond that, I want to keep all images created in the last 90 days with an SHA tag.

I'm happy for anything untagged to be removed.

Applying the below rules almost works; only it seems that because there's a match on the sha tag, the prod and test images would be expired.

{
  "rules": [
    {
      "rulePriority": 1,
      "description": "Remove untagged images",
      "selection": {
        "tagStatus": "untagged",
        "countType": "imageCountMoreThan",
        "countNumber": 1
      },
      "action": {
        "type": "expire"
      }
    },
    {
      "rulePriority": 100,
      "description": "Purge non-deployed images over 90 days old",
      "selection": {
        "countType": "sinceImagePushed",
        "countUnit": "days",
        "countNumber": 90,
        "tagStatus": "tagged",
        "tagPrefixList": [
          "sha"
        ]
      },
      "action": {
        "type": "expire"
      }
    }
  ]
}

I can't find any documentation on adding a "NOT" rule, and trying an exclamation doesn't work.

    {
      "rulePriority": 100,
      "description": "Purge non-deployed images over 90 days old",
      "selection": {
        "countType": "sinceImagePushed",
        "countUnit": "days",
        "countNumber": 90,
        "tagStatus": "tagged",
        "tagPrefixList": [
          "!test", "!prod"
        ]
      },
      "action": {
        "type": "expire"
      }
    }