CSI node plugin is healthy but SELinux labeling blocks the kubelet from using the published socket

The DaemonSet looks ready, yet mounts fail because the host path and socket labels do not allow the kubelet domain to connect.