fedora-intune: give the Intune compliance check a Defender health snapshot

Himmelblau runs the custom compliance script inside himmelblaud-tasks,
and Defender refuses to answer `mdatp health` there: the daemon can't
read /proc/<himmelblaud_tasks>/cmdline while checking the caller
("Permission denied" in microsoft_defender_err.log). The script saw no
daemon, and every Defender rule failed although Defender was healthy.

Add mdatp-health-snapshot.timer, which saves the health fields to
/run/mdatp-health every 5 minutes as root, outside that service. The
compliance script reads the snapshot when it's under 20 minutes old and
otherwise asks mdatp directly, so it still works on other distros.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

images/fedora-intune/intune/defender-compliance.sh

@@ -10,11 +10,21 @@
 # instead of as a script error.
 
 MDATP=/usr/bin/mdatp
+# Under Himmelblau, Defender won't answer `mdatp health` from this script, so
+# a root timer may save the fields in /run/mdatp-health (the fedora-intune
+# image does). Used when under 20 minutes old, otherwise mdatp is asked.
+SNAPSHOT=/run/mdatp-health
+
+if [[ -n "$(find "${SNAPSHOT}/healthy" -mmin -20 2>/dev/null)" ]]; then
+  raw_field() { cat "${SNAPSHOT}/$1" 2>/dev/null; }
+else
+  raw_field() { "${MDATP}" health --field "$1" 2>/dev/null; }
+fi
 
 # Print one `mdatp health` field without quotes or a trailing " [managed]".
 # Unlicensed or unonboarded, mdatp prints "ATTENTION: ..." lines first.
 field() {
-  "${MDATP}" health --field "$1" 2>/dev/null | grep -v '^ATTENTION' | tail -n1 \
+  raw_field "$1" | grep -v '^ATTENTION' | tail -n1 \
     | sed -e 's/ \[managed\]$//' -e 's/^"//' -e 's/"$//'
 }