A custom SELinux fcontext regex loads before the broader application path rule and restorecon applies the wrong label set

The policy file looks correct, yet precedence inside the matching rules changes the final label assignment.