I ran restorecon -Rv /
Don’t ever do that on an ostree-managed system. See 1259018 – restorecon changes many file labels following a clean install
As the bug said we’re eventually going to do some work to fix this, it’s just tricky.
It’s possible to re-pull all of the objects, see POC: fsck repair by krnowak · Pull Request #345 · ostreedev/ostree · GitHub