fedora-intune: fix boot issues, add Himmelblau variant

Fixes found by building and inspecting the image:

- Select the Intune authselect profile with-altfiles. Without it system
  users in /usr/lib/passwd (gdm, pipewire, mdatp) do not resolve and the
  login screen never starts. The build now fails if gdm does not resolve.
- Ship /opt as a plain directory (opt-usrlocal: root). Defender installs
  to /opt/microsoft/mdatp and keeps state in /var/opt/microsoft/mdatp;
  with the default /opt -> /var/opt symlink those were the same
  read-only directory. rpm-ostree still relocates /opt content to
  /usr/lib/opt, so finalize.d/60-opt-links links it back (only for images
  where /opt is a directory; fedora-cosmic/remote are unaffected).
- Run Defender's %post on first boot (mdatp-firstboot.service): in a
  compose /var is read-only and the machine GUID/state must not be
  shared. mdatp.service waits for it.

New image fedora-intune-himmelblau: the same workstation with Entra ID
sign-in through Himmelblau (Community Nightly packages), which joins the
device at the first sign-in and enrolls it in Intune (apply_policy)
instead of the Microsoft Intune app. Workstation, Edge and Defender
manifests move to images/shared so both images use them; build.sh copies
images/shared/*.yaml and CI builds both images in one matrix job.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

.gitea/workflows/build.yaml

@@ -175,17 +175,22 @@ jobs:
     steps: *build_steps
 
   build-intune:
-    name: fedora-intune (44)
+    name: ${{ matrix.image }} (44)
     needs: changes
     if: needs.changes.outputs.intune == 'true'
     runs-on: job-v2
 
+    strategy:
+      fail-fast: false
+      matrix:
+        image: [fedora-intune, fedora-intune-himmelblau]
+
     container:
       image: "quay.io/fedora-ostree-desktops/buildroot:44"
       options: "--security-opt=label=disable --privileged --user 0:0 --device=/dev/fuse --volume /:/run/host:rw"
 
     env:
-      IMAGE: fedora-intune
+      IMAGE: ${{ matrix.image }}
       DISTRO: "44"
       ARCH: x86_64
       REGISTRY: git.plabble.org/misthios
@@ -215,7 +220,7 @@ jobs:
         env:
           RELEASE_TOKEN: ${{ secrets.RELEASE_TOKEN }}
         run: |
-          for image in fedora-cosmic fedora-remote fedora-intune; do
+          for image in fedora-cosmic fedora-remote fedora-intune fedora-intune-himmelblau; do
             ./prune-releases.sh "${image}"
           done
       - name: Prune old registry tags
@@ -227,6 +232,6 @@ jobs:
           authfile=/tmp/prune-auth.json
           echo "${REGISTRY_TOKEN}" | skopeo login -u "${REGISTRY_USERNAME}" \
             --password-stdin --authfile "${authfile}" git.plabble.org
-          for image in fedora-cosmic fedora-remote fedora-intune; do
+          for image in fedora-cosmic fedora-remote fedora-intune fedora-intune-himmelblau; do
             AUTHFILE="${authfile}" ./prune-registry.sh "${image}" Misthios 44 rawhide
           done