Is it possible to annotate an existing k8s namespace ("kube-system") with pulumi?

I don't believe so. We're working resource "adoption" so you could pull existing resources into your Pulumi app to manage them, but it's not yet available.