Every agent receives the rules before it changes anything and must follow them, so it knows to leave those files alone; if the same holds for Staging, write it there too, because each tab has its own rules.
Since version 13.2.49.74 there is no Do not edit category and SyncNow no longer proposes such paths by itself: a rule has no list of paths, and SyncNow does not compare the files of a write with the text of a rule. A rule is a binding instruction that agents read, not a lock: the write tools do not refuse a file because a rule names it, and changes made outside SyncNow are not intercepted.
Say in the rule where the real change belongs, for example the source file a page is generated from, so the agent can do the right thing instead. If an agent changed such a file anyway, Activity shows which work did it, and the previous content can often be put back: see Can I get back a file that an agent overwrote?.