A little additional explanation of why the switch to copytree would have
fixed this, at least in the SELinux case: under SELinux, files typically
get labelled with a context based on where they're created. Copying creates
a *new* file at the destination with the correct context for that location
(based on system policy), but moving an *existing* file will retain its
*original* context - you then have to call "restorecon" to adjust the
context for the new location.

I assume Windows NTFS ACLs are similar, being set based on the parent
directory at creation and then preserved when moved.

Moral of the story? These days, if you're relocating files to a different
directory, copying and then deleting the original will be significantly
more consistent across different environments. OS level move operations are
best avoided in cross platform code, unless it's within the same directory,
or you really need the speed and are prepared to sort out the relevant
access control tweaks afterwards.