fedora-intune: fix boot issues, add Himmelblau variant

Fixes found by building and inspecting the image:

- Select the Intune authselect profile with-altfiles. Without it system
  users in /usr/lib/passwd (gdm, pipewire, mdatp) do not resolve and the
  login screen never starts. The build now fails if gdm does not resolve.
- Ship /opt as a plain directory (opt-usrlocal: root). Defender installs
  to /opt/microsoft/mdatp and keeps state in /var/opt/microsoft/mdatp;
  with the default /opt -> /var/opt symlink those were the same
  read-only directory. rpm-ostree still relocates /opt content to
  /usr/lib/opt, so finalize.d/60-opt-links links it back (only for images
  where /opt is a directory; fedora-cosmic/remote are unaffected).
- Run Defender's %post on first boot (mdatp-firstboot.service): in a
  compose /var is read-only and the machine GUID/state must not be
  shared. mdatp.service waits for it.

New image fedora-intune-himmelblau: the same workstation with Entra ID
sign-in through Himmelblau (Community Nightly packages), which joins the
device at the first sign-in and enrolls it in Intune (apply_policy)
instead of the Microsoft Intune app. Workstation, Edge and Defender
manifests move to images/shared so both images use them; build.sh copies
images/shared/*.yaml and CI builds both images in one matrix job.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

images/fedora-intune/defender.yaml

@@ -1,39 +0,0 @@
-# Microsoft Defender for Endpoint on Linux (mdatp), RHEL 10 build.
-#
-# mdatp's %post does the real install: it writes mdatp.service and the
-# mde_netfilter_v2 units, loads its SELinux module and creates a machine GUID
-# and state under /var/opt/microsoft/mdatp. In a compose the daemon cannot
-# start and /var is not shipped, so the units and SELinux module are handled
-# here and the per-machine state is left to the first start on the device.
-#
-# Onboarding is per tenant and not part of the image: run the onboarding script
-# from the Defender portal on the device (see the Intune test doc).
-
-repo-packages:
-  - repo: microsoft-rhel10
-    packages:
-      - mdatp
-
-packages:
-  # Used by the Defender TVM/inventory scripts and the onboarding script.
-  - python3
-
-add-files:
-  - ["50-defender.preset", "/usr/lib/systemd/system-preset/50-defender.preset"]
-
-postprocess:
-  - |
-    #!/usr/bin/env bash
-    set -xeuo pipefail
-    conf=/opt/microsoft/mdatp/conf
-    # Units the %post copies into place; install them if it did not get there.
-    for unit in mdatp.service mde_netfilter_v2.service mde_netfilter_v2.socket; do
-      if [[ ! -f "/usr/lib/systemd/system/${unit}" ]]; then
-        install -m 0644 "${conf}/${unit}" "/usr/lib/systemd/system/${unit}"
-      fi
-    done
-    semodule -n -i "${conf}/selinux_policies/out/mdatp_service.pp"
-    # Never ship a machine GUID or onboarding state baked in at build time.
-    ls -laR /etc/opt/microsoft /var/opt/microsoft 2>/dev/null || true
-    rm -rf /var/opt/microsoft/mdatp
-    rm -f /etc/opt/microsoft/mdatp/mdatp_onboard.json