secure-ntp: label /run/chrony-dhcp so chronyd can read the NTS source under SELinux

Second bench defect after removing the distro 20-chrony-dhcp clobberer
(secure-ntp-5a3eaed, comet-beacon-54): the dispatcher wrote the correct
`server ntp.fleet.lab iburst nts` line, but chrony loaded ZERO sources --
`chronyc reload sources` returned 200 OK yet authdata/sources stayed empty.

Root cause (AVC): chronyd_t was DENIED read on the .sources files because they and
/run/chrony-dhcp itself were labeled generic var_run_t; chronyd_t may only read its
own chronyd_var_run_t. The dispatcher's `mkdir -p` creates the dir as var_run_t and
files inherit it. The distro 20-chrony-dhcp we removed had been restorecon-ing them
to the readable label, so removing it exposed a latent labelling gap.

Stock RHEL policy already maps /run/chrony-dhcp -> chronyd_var_run_t (a restorecon
relabels it and chrony immediately reaches NTS Cook 8). Fix: ship
/etc/tmpfiles.d/chrony-dhcp.conf so systemd-tmpfiles pre-creates the dir with that
fcontext at sysinit, before any NM event -- the dispatcher's files then inherit
chronyd_var_run_t and chronyd can read them. No SELinux allow rules needed
(bench-verified: after the fix a real NM event wrote the source as chronyd_var_run_t,
no AVC, authdata -> NTS Cook 8). Applies in both secure_ntp modes.

Also: the dispatcher now skips `lo` -- it was writing a spurious lo.sources
duplicate of the same server (the distro script had skipped loopback).

BENCH-VERIFY on the next clean build: a normal boot leaves the source file labeled
chronyd_var_run_t (ls -Z), no lo.sources, and authdata reaches NTS/cookies>0 with no
manual step.

docs/secure-ntp-design.md

@@ -146,10 +146,31 @@ and tcp/4460 were **all already correct**; the collision was the sole defect.
 
 Fix: the provisioner removes `/usr/lib/NetworkManager/dispatcher.d/20-chrony-dhcp`
 at build time (our dispatcher supersedes it in both modes); `20-chrony-onoffline`
-is left in place (harmless — it only marks sources online/offline). **BENCH-VERIFY
-on the next clean build:** with the distro script gone, a normal boot leaves
-`/run/chrony-dhcp/<iface>.sources` = the NTS line and `chronyc authdata` reaches
-`NTS`/cookies > 0 with no manual intervention.
+is left in place (harmless — it only marks sources online/offline).
+
+**2026-07-12 (comet-beacon-54, `secure-ntp-5a3eaed`) — SELinux label on the source
+files (FIXED).** With the clobberer gone the dispatcher wrote the correct
+`server ntp.fleet.lab iburst nts` line, but chrony still loaded **zero** sources —
+`chronyc reload sources` returned `200 OK` yet `authdata`/`sources` stayed empty.
+Root cause (AVC): `chronyd_t` was **denied read** on the `.sources` files because
+they (and `/run/chrony-dhcp` itself) were labeled generic **`var_run_t`** —
+`chronyd_t` may only read its own **`chronyd_var_run_t`**. The dispatcher's
+`mkdir -p` creates the dir as `var_run_t` and files inherit it; the distro
+`20-chrony-dhcp` we removed had been the thing `restorecon`-ing them to the readable
+label, so removing it exposed a latent labelling gap. Stock RHEL policy already maps
+`/run/chrony-dhcp` → `chronyd_var_run_t` (a `restorecon -R` relabels it and chrony
+then reaches `NTS Cook 8`). Fix: ship `/etc/tmpfiles.d/chrony-dhcp.conf`
+(`d /run/chrony-dhcp …`) so systemd-tmpfiles pre-creates the dir with the correct
+fcontext at sysinit — files the dispatcher writes then **inherit** `chronyd_var_run_t`
+(bench-verified: after the fix a real NM event wrote `enp0s31f6.sources` as
+`chronyd_var_run_t`, no AVC, `authdata` → `NTS Cook 8`). No SELinux allow rules
+needed. Also fixed: the dispatcher now **skips `lo`** (it was writing a spurious
+`lo.sources` duplicate of the same server, which the distro script had skipped).
+
+**BENCH-VERIFY on the next clean build:** a normal boot leaves
+`/run/chrony-dhcp/<iface>.sources` = the NTS line **labeled `chronyd_var_run_t`**
+(`ls -Z`), no `lo.sources`, and `chronyc -N authdata` reaches `NTS`/cookies > 0 with
+**no manual intervention**.
 
 ## Toggle