flightctl-agent loses SELinux context (unlabeled_t) after bootc deployment switch on RHEL 9

## Summary

After a bootc deployment switch triggered by an OS image update (flightctl-agent on RHEL 9 bootc, managed via Red Hat Edge Manager / flightctl), `/usr/bin/flightctl-agent` ends up with SELinux context `unlabeled_t` on overlay. systemd cannot exec the agent under SELinux enforcing; the service restart-loops and the device stops checking in to management.

On a **fresh install before any deployment switch**, the same binary has the correct label:

```
# Before any OS image change
# ls -Z /usr/bin/flightctl-agent
system_u:object_r:flightctl_agent_exec_t:s0 /usr/bin/flightctl-agent
```

After switch + reboot:

```
# ls -Z /usr/bin/flightctl-agent
system_u:object_r:unlabeled_t:s0 /usr/bin/flightctl-agent
```

Example AVC:

```
avc: denied { execute } for pid=2143 comm="(tl-agent)" name="flightctl-agent" dev="overlay"
scontext=system_u:system_r:init_t:s0 tcontext=system_u:object_r:unlabeled_t:s0 tclass=file
trawcon="system_u:object_r:flightctl_agent_exec_t:s0"
```

systemd:

```
flightctl-agent.service: Failed to locate executable /usr/bin/flightctl-agent: Permission denied
flightctl-agent.service: Failed at step EXEC spawning /usr/bin/flightctl-agent: Permission denied
```

Disabling SELinux works around it. `restorecon` on `/usr` does not persist because `/usr` is read-only on bootc; temporary fix via `bootc usr-overlay` is lost on reboot.

## Reproducibility

Reproduces when switching to the **same image content with only a different tag** (not caused by image content changes).

## Steps to reproduce

1. Build a RHEL 9 bootc image that installs `flightctl-agent` and `flightctl-selinux` from the edge-manager 1.2 RPM repo; enable `flightctl-agent.service` and mask `bootc-fetch-apply-updates.timer`.
2. Install the device from a bootc/anaconda ISO that points at an initial OS image reference.
3. Enroll the device into a flightctl/RHEM 1.2 management service.
4. Confirm before update: `ls -Z /usr/bin/flightctl-agent` shows `flightctl_agent_exec_t`.
5. Change the device OS image reference in management to a different tag of the same bootc image (or any new bootc image reference).
6. After bootc switch/reboot: agent fails; `ls -Z /usr/bin/flightctl-agent` shows `unlabeled_t`.

## Environment

- RHEL 9 bootc (`registry.redhat.io/rhel9/rhel-bootc:9.6`)
- flightctl / edge-manager 1.2 (server + agent)
- SELinux enforcing

## Expected

After deployment switch, `/usr/bin/flightctl-agent` retains `flightctl_agent_exec_t` and the agent service starts.

## Related

- Possibly same class of SELinux xattr/metadata issues as #1346

Start by reproducing the deployment switch and reboot sequence, then inspect how the bootc switch handles SELinux metadata on /usr and compare with the related issue #1346. Done means /usr/bin/flightctl-agent retains flightctl_agent_exec_t after the switch and reboot, and flightctl-agent.service starts under enforcing SELinux.

Written by the indexing model from the issue text.