fedora-intune: give the Intune compliance check a Defender health snapshot

Himmelblau runs the custom compliance script inside himmelblaud-tasks,
and Defender refuses to answer `mdatp health` there: the daemon can't
read /proc/<himmelblaud_tasks>/cmdline while checking the caller
("Permission denied" in microsoft_defender_err.log). The script saw no
daemon, and every Defender rule failed although Defender was healthy.

Add mdatp-health-snapshot.timer, which saves the health fields to
/run/mdatp-health every 5 minutes as root, outside that service. The
compliance script reads the snapshot when it's under 20 minutes old and
otherwise asks mdatp directly, so it still works on other distros.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

images/fedora-intune/files/50-defender.preset

@@ -2,3 +2,5 @@
 enable mdatp-firstboot.service
 enable mdatp.service
 enable mde_netfilter_v2.socket
+# Health snapshot for the Intune compliance script.
+enable mdatp-health-snapshot.timer