fix(configuration): disable selinux with selinux=0 on el9 when the feature is off

roles/configuration/tasks/selinux.yml

@@ -22,10 +22,12 @@
         mode: "0644"
 
     # Fedora: setfiles segfaults during bootstrap chroot relabeling, so SELinux
-    # is left permissive and expected to relabel on first boot.
-    - name: Disable SELinux
+    # is left permissive and expected to relabel on first boot. Opting out writes
+    # disabled here and selinux=0 on the kernel cmdline (grub.yml), the only form
+    # EL9 honours.
+    - name: Set the SELinux mode
       when: os == "fedora" or not system_cfg.features.selinux.enabled | bool
       ansible.builtin.lineinfile:
         path: /mnt/etc/selinux/config
         regexp: ^SELINUX=
-        line: SELINUX=permissive
+        line: "SELINUX={{ 'permissive' if system_cfg.features.selinux.enabled | bool else 'disabled' }}"