fedora-intune: fix boot issues, add Himmelblau variant

Fixes found by building and inspecting the image:

- Select the Intune authselect profile with-altfiles. Without it system
  users in /usr/lib/passwd (gdm, pipewire, mdatp) do not resolve and the
  login screen never starts. The build now fails if gdm does not resolve.
- Ship /opt as a plain directory (opt-usrlocal: root). Defender installs
  to /opt/microsoft/mdatp and keeps state in /var/opt/microsoft/mdatp;
  with the default /opt -> /var/opt symlink those were the same
  read-only directory. rpm-ostree still relocates /opt content to
  /usr/lib/opt, so finalize.d/60-opt-links links it back (only for images
  where /opt is a directory; fedora-cosmic/remote are unaffected).
- Run Defender's %post on first boot (mdatp-firstboot.service): in a
  compose /var is read-only and the machine GUID/state must not be
  shared. mdatp.service waits for it.

New image fedora-intune-himmelblau: the same workstation with Entra ID
sign-in through Himmelblau (Community Nightly packages), which joins the
device at the first sign-in and enrolls it in Intune (apply_policy)
instead of the Microsoft Intune app. Workstation, Edge and Defender
manifests move to images/shared so both images use them; build.sh copies
images/shared/*.yaml and CI builds both images in one matrix job.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

images/fedora-intune/intune.yaml

@@ -1,23 +1,14 @@
-# Microsoft Intune app for Linux (intune-portal), the Microsoft identity broker
-# and Microsoft Edge (needed for Conditional Access to Microsoft 365 web apps).
+# Microsoft Intune app for Linux (intune-portal) and the Microsoft identity
+# broker, from the microsoft-rhel10 repo (shared/repos/microsoft.repo).
 #
 # Fedora is not a supported Intune distribution. The RHEL 10 builds are used
-# because they link against the same library generation as Fedora 44. The
-# repos are limited to these packages with includepkgs (repos/microsoft.repo),
-# so nothing else from the RHEL repo can replace a Fedora package.
-
-repos:
-  - microsoft-rhel10
-  - microsoft-edge
+# because they link against the same library generation as Fedora 44.
 
 repo-packages:
   - repo: microsoft-rhel10
     packages:
       - intune-portal
       - microsoft-identity-broker
-  - repo: microsoft-edge
-    packages:
-      - microsoft-edge-stable
 
 packages:
   # intune-portal scriptlet dependencies (authselect profile + SELinux module)
@@ -26,6 +17,7 @@ packages:
   - checkpolicy
   - policycoreutils
   - sssd-client
+  - nss-altfiles
   # Secret storage for the identity broker tokens.
   - gnome-keyring
   - libsecret
@@ -57,7 +49,10 @@ postprocess:
         -e '/^session[[:space:]]\+required[[:space:]]\+pam_unix.so/a session     optional                                     pam_intune.so' \
         "${profile}/${f}"
     done
-    authselect select custom/intune-profile --force --nobackup
+    # with-altfiles: system users (gdm, pipewire, mdatp, ...) live in
+    # /usr/lib/passwd on rpm-ostree systems, not in /etc/passwd as on RHEL.
+    authselect select custom/intune-profile with-altfiles --force --nobackup
+    getent passwd gdm >/dev/null
 
   - |
     #!/usr/bin/env bash