Host parameters take precedence over facts and this can have unexpected consequences...
https://github.com/theforeman/puppet-foreman/pull/378
My money is this also being the root-cause here.
https://ask.puppet.com/question/16601/why-is-selinux-fact-different-for-puppet-then-for-facter/

It'd be nice if foreman could somehow warn users if they're overriding facts,
(especially core-facts and super especially the 'selinux' fact as a conflicting 'selinux'
parameter was being used in the community kickstart templates
https://github.com/theforeman/community-templates/pull/286).