See this answer and this issue for details on how SELinux is enforced on Android. In short it depends on cmdline parameters of kernel and build configuration of init.
Check on your device:
~# cat /proc/cmdline
It must contain androidboot.selinux=permissive. You need to remove this parameter from kernel cmdline permanently in order to enforce SELinux on ...
This might not be a direct solution to your problem, but I'm sharing my thoughts on it.
It's not very likely for RAM on embedded systems to get defective. And if it does, solutions might not be readily available, except if someone has already done that specifically for your device.
Modern flash storage devices manage bad blocks on their own, ...
Custom root of trust has to be set from fastboot according to docs. The OEM can implement it in different ways, the docs recommend that a custom certificate can only be installed from UNLOCKED state
Once your certificate is installed as root of trust, you can boot in LOCKED mode (only binaries signed by either you or the OEM will be allowed to boot)