SELinux permission denied error when installing a kernel module via an RPM package

Question

I am trying to create an RPM installer that at loads a kernel module using an install script that calls insmod. The directory it's installing to is /opt/nfast and looking at /etc/selinux/targeted/contexts/files/file_context I note that that files installed here get the default context:

/opt/nfast(/.*)?        system_u:object_r:pki_common_t:s0

Which I see once the rpm installer has done its job:

[root@localhost nfast]# ls -laZ
total 12
drwxr-xr-x. 2 root root system_u:object_r:pki_common_t:s0   37 May 12 00:47 .
drwxr-xr-x. 3 root root system_u:object_r:usr_t:s0          19 May 12 00:44 ..
-rw-r--r--. 1 root root system_u:object_r:pki_common_t:s0 4296 May 12 00:46 hello.ko
-rwxr-xr-x. 1 root root system_u:object_r:pki_common_t:s0   48 May 12 00:46 install

I've created a minimal example as seen below, and I cannot work out why it fails to install via the RPM installer, but works fine when I directly call the script afterwards via the command line.

[root@localhost ~]# rpm -ivh hello-1-1.el8.x86_64.rpm

Verifying...                          ################################# [100%]
Preparing...                          ################################# [100%]
Updating / installing...
   1:hello-1-1.el8                    ################################# [100%]
insmod: ERROR: could not insert module /opt/nfast/hello.ko: Permission denied
warning: %post(hello-1-1.el8.x86_64) scriptlet failed, exit status 1

What is happening? Why is my RPM being disallowed to do this?

SPECS/hello.spec

Name:           hello
Version:        1
Release:        1%{?dist}
Summary:        none

License:    none
Source0:        %{name}-%{version}.tar.gz

BuildRequires:  gcc make

%define debug_package %{nil}

%description
none

%prep
%autosetup

%build
%make_build

%install
rm -rf $RPM_BUILD_ROOT
mkdir -p %{buildroot}/opt/nfast
cp %{_builddir}/%{name}-%{version}/hello.ko %{buildroot}/opt/nfast
install -D -m 0755 %{_builddir}/%{name}-%{version}/install %{buildroot}/opt/nfast

%post
/opt/nfast/install

%files
/opt/nfast/hello.ko
/opt/nfast/install

%changelog
* Thu May 12 2022 Sam
- 

SOURCES/hello-1/hello.c

#include <linux/module.h>
#include <linux/kernel.h>

int init_module(void)
{
    printk(KERN_INFO "hello world\n");
    return 0;
}

void cleanup_module(void)
{
    printk(KERN_INFO "goodbye world\n");
}

SOURCES/hello-1/Makefile

obj-m += hello.o

all:
    make -C /lib/modules/$(shell uname -r)/build M=$(PWD) modules
clean:
    make -C /lib/modules/$(shell uname -r)/build M=$(PWD) clean

SOURCES/hello-1/install

#!/bin/sh
dos="/opt/nfast/hello.ko"
insmod $dos