Creating arbitrary new toplevel directories (e.g. `/app` or `aimodel`) will result in the default SELinux label `default_t`. Most domains are denied access to this.

We should either:

• Change the SELinux policy to make the generic fallback case be usr_t
• We could do just this in the bootc container stack (perhaps preferable to start); but implementing that is a bit ugly