Clevis TPM2 LUKS binding to PCR 7 fails to unlock on reboot when configured in Kickstart %post

Issue

• A virtual machine or physical host deployed using Kickstart fails to automatically unlock a LUKS-encrypted volume at boot via TPM2 using Clevis, when the binding was set up in the %post installation phase.
• During boot, the system prompts for the LUKS passphrase rather than auto-unlocking.
• The following error messages appear in the log journal or console screen during boot:

    clevis-luks-askpass[897]: ERROR: Esys_Unseal(0x99D) - tpm:session(1):a policy check failed
    clevis-luks-askpass[897]: ERROR: Unable to run tpm2_unseal
    clevis-luks-askpass[871]: Unsealing jwk from TPM failed!

• Attempting a manual unlock or listing with clevis shows:

# clevis luks list -d /dev/vda3
1: tpm2 '{"hash":"sha256","key":"rsa","pcr_bank":"sha256","pcr_ids":"7"}'
# clevis luks unlock -d /dev/vda3
WARNING:esys:src/tss2-esys/api/Esys_Unseal.c:295:Esys_Unseal_Finish() Received TPM Error 
ERROR:esys:src/tss2-esys/api/Esys_Unseal.c:98:Esys_Unseal() Esys Finish ErrorCode (0x0000099d)
Error: a policy check failed (associated with session number 1)