It seems that the hostname handling code in our downstream ironic-agent plugin is racy. The sequence of events as recovered from a CI job run:

1. IPA starts and polls all hardware manager
2. Our hardware managers detects the hostname, fixes it if needed and records in a variable
3. IPA proceeds with its regular business, including inspection
4. During inspection, a different hostname is returned from socket.gethostname, and it gets reported back to Ironic and thus BMO.
5. During OS installation, our plugin configures Ignition with the earlier hostname, not the one reported in Inspection.
6. This way, the Machine resource ends up with the later (correct) hostname, while the Node boots with an earlier hostname. They mismatch, and the Node does not get approved.