I only tested on the puppet server.
If I set simp_options::selinux: true (default for simp) and set selinux::ensure: permissive in hiera in the host/puppt file it stays enforcing. If I manually change it to permissive, it stays permissive even when switched to enforcing.
This only happens on 6.9. 7.3 works fine.