fedora-intune: take the first Defender health snapshot right after boot

The first snapshot came 2 minutes after boot, so the compliance check at
the first sign-in found none, fell back to mdatp (which won't answer it)
and reported Defender as not running. Himmelblau then doesn't check again
for 8 hours. Start the timer 20 seconds after boot, and wait up to
2 minutes for the daemon to answer so that snapshot isn't a false
"not running". The timer runs it in the background, so boot isn't held up.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

images/fedora-intune/files/mdatp-health-snapshot

@@ -24,6 +24,13 @@ FIELDS=(
   app_version
 )
 
+# Right after boot the daemon may not answer yet; give it up to 2 minutes so
+# the first snapshot isn't a false "not running".
+for _ in $(seq 1 24); do
+  [[ "$("${MDATP}" health --field healthy 2>/dev/null | tail -n1)" =~ ^(true|false)$ ]] && break
+  sleep 5
+done
+
 tmp="$(mktemp -d "${DEST}.XXXXXX")"
 trap 'rm -rf "${tmp}"' EXIT
 for field in "${FIELDS[@]}"; do

images/fedora-intune/files/mdatp-health-snapshot.timer

@@ -2,7 +2,9 @@
 Description=Save Microsoft Defender health every 5 minutes
 
 [Timer]
-OnBootSec=2min
+# Early, so the compliance check at the first sign-in after boot finds a
+# snapshot; Himmelblau doesn't check again for 8 hours.
+OnBootSec=20s
 OnUnitActiveSec=5min
 
 [Install]