fedora-intune: install Defender from Microsoft's Fedora 44 repo

The RHEL 10 repo was there for the Intune app, which only ships for RHEL;
that app is gone and the repo now only provides mdatp. Use Microsoft's
Fedora 44 repo instead: Fedora is a supported Defender distribution
(servers and the Linux desktop preview), and it carries a newer build
(101.26091.0003 vs 101.26081.0010 in the RHEL 10 repo). Same signing key
and signed metadata.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

images/fedora-intune/build.conf

@@ -4,7 +4,7 @@ BUILD_MODE=upstream
 
 UPSTREAM_REPO="https://gitlab.com/fedora/ostree/ci-test.git"
 
-# Stable only; Defender comes from Microsoft's RHEL 10 repo, not rawhide.
+# Stable only; Microsoft's Defender repo (fedora/44) has no rawhide build.
 declare -A UPSTREAM_REFS=(
   [44]=f44
 )

images/fedora-intune/defender.yaml

@@ -1,5 +1,5 @@
-# Microsoft Defender for Endpoint on Linux (mdatp), RHEL 10 build, from the
-# microsoft-rhel10 repo (repos/microsoft.repo).
+# Microsoft Defender for Endpoint on Linux (mdatp), Fedora 44 build, from the
+# microsoft-fedora44 repo (repos/microsoft.repo).
 #
 # mdatp's %post does the real install: units, SELinux module, and per-machine
 # state under /var/opt/microsoft/mdatp (machine GUID, definitions database,
@@ -11,7 +11,7 @@
 # from the Defender portal on the device.
 
 repo-packages:
-  - repo: microsoft-rhel10
+  - repo: microsoft-fedora44
     packages:
       - mdatp
 

images/fedora-intune/manifest.yaml

@@ -27,7 +27,7 @@ opt-usrlocal: root
 
 repos:
   - himmelblau
-  - microsoft-rhel10
+  - microsoft-fedora44
   - microsoft-edge
 
 include:

images/fedora-intune/repos/microsoft.repo

@@ -1,9 +1,13 @@
 # packages.microsoft.com, limited with includepkgs to the packages the image
-# uses, so nothing else from the RHEL repo can replace a Fedora package.
+# uses, so nothing else from the Microsoft repo can replace a Fedora package.
+#
+# Fedora 44 build of Defender (mdatp): Fedora is a supported Defender
+# distribution, servers and desktops. Pinned to 44 rather than $releasever so a
+# new Fedora release doesn't fail the build before Microsoft publishes its repo.
 
-[microsoft-rhel10]
-name=Microsoft Production (RHEL 10)
-baseurl=https://packages.microsoft.com/rhel/10/prod/
+[microsoft-fedora44]
+name=Microsoft Production (Fedora 44)
+baseurl=https://packages.microsoft.com/fedora/44/prod/
 enabled=1
 gpgcheck=1
 repo_gpgcheck=1