fedora-intune: fix boot issues, add Himmelblau variant

Fixes found by building and inspecting the image:

- Select the Intune authselect profile with-altfiles. Without it system
  users in /usr/lib/passwd (gdm, pipewire, mdatp) do not resolve and the
  login screen never starts. The build now fails if gdm does not resolve.
- Ship /opt as a plain directory (opt-usrlocal: root). Defender installs
  to /opt/microsoft/mdatp and keeps state in /var/opt/microsoft/mdatp;
  with the default /opt -> /var/opt symlink those were the same
  read-only directory. rpm-ostree still relocates /opt content to
  /usr/lib/opt, so finalize.d/60-opt-links links it back (only for images
  where /opt is a directory; fedora-cosmic/remote are unaffected).
- Run Defender's %post on first boot (mdatp-firstboot.service): in a
  compose /var is read-only and the machine GUID/state must not be
  shared. mdatp.service waits for it.

New image fedora-intune-himmelblau: the same workstation with Entra ID
sign-in through Himmelblau (Community Nightly packages), which joins the
device at the first sign-in and enrolls it in Intune (apply_policy)
instead of the Microsoft Intune app. Workstation, Edge and Defender
manifests move to images/shared so both images use them; build.sh copies
images/shared/*.yaml and CI builds both images in one matrix job.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

images/fedora-intune-himmelblau/build.conf

@@ -0,0 +1,10 @@
+# Build configuration for images/fedora-intune-himmelblau. Sourced by build.sh.
+
+BUILD_MODE=upstream
+
+UPSTREAM_REPO="https://gitlab.com/fedora/ostree/ci-test.git"
+
+# Stable only, like fedora-intune.
+declare -A UPSTREAM_REFS=(
+  [44]=f44
+)

images/fedora-intune-himmelblau/files/50-himmelblau-user.preset

@@ -0,0 +1,3 @@
+# Intune compliance check at login and on a timer, for every user.
+enable himmelblau-compliance-check.service
+enable himmelblau-compliance-check.timer

images/fedora-intune-himmelblau/files/50-himmelblau.preset

@@ -0,0 +1,4 @@
+# Himmelblau daemons; they pull in their sockets with Requires=.
+enable himmelblaud.service
+enable himmelblaud-tasks.service
+enable himmelblau-hsm-pin-init.service

images/fedora-intune-himmelblau/files/himmelblau.conf

@@ -0,0 +1,17 @@
+# Himmelblau configuration. See himmelblau.conf(5) and
+# https://himmelblau-idm.org/docs/reference/himmelblau-conf/
+#
+# No tenant settings are needed: `domain` defaults to the domain of the first
+# user who signs in, and that user joins the device to Entra ID. Restrict who
+# may sign in with pam_allow_groups (group object IDs or UPNs).
+
+[global]
+# Enroll the device in Intune and apply/report compliance policies.
+apply_policy = true
+# Fedora's admin group; members of sudo_groups (Entra group object IDs) are
+# added to it.
+local_sudo_group = wheel
+# Home directories named after the account (e.g. /home/jdoe), with a UPN alias.
+home_attr = CN
+home_alias = SPN
+use_etc_skel = true

images/fedora-intune-himmelblau/himmelblau.yaml

@@ -0,0 +1,68 @@
+# Himmelblau: Entra ID sign-in (PAM/NSS), Entra join, Hello PIN, Intune
+# enrollment and compliance, and browser SSO.
+
+repo-packages:
+  - repo: himmelblau
+    packages:
+      - himmelblau
+      - pam-himmelblau
+      - nss-himmelblau
+      - himmelblau-selinux
+      # Shows a QR code on the login screen for the MFA/device-code prompts.
+      - himmelblau-qr-greeter
+      # Entra SSO in Edge (native messaging host) via the Himmelblau broker.
+      - himmelblau-broker
+      - himmelblau-sso
+
+packages:
+  - authselect
+  - nss-altfiles
+  # himmelblau-selinux compiles its policy module at install time.
+  - make
+  - selinux-policy-devel
+
+add-files:
+  - ["himmelblau.conf", "/etc/himmelblau/himmelblau.conf"]
+  - ["50-himmelblau.preset", "/usr/lib/systemd/system-preset/50-himmelblau.preset"]
+  - ["50-himmelblau-user.preset", "/usr/lib/systemd/user-preset/50-himmelblau-user.preset"]
+
+postprocess:
+  # The package's %post selects its authselect vendor profile but drops
+  # with-altfiles; without it system users (gdm, pipewire, mdatp, ...) in
+  # /usr/lib/passwd do not resolve and the login screen never starts.
+  - |
+    #!/usr/bin/env bash
+    set -xeuo pipefail
+    authselect select himmelblau with-altfiles with-pam-gnome-keyring --force --nobackup
+    for user in gdm mdatp; do
+      getent passwd "${user}" >/dev/null
+    done
+    grep -q pam_himmelblau.so /etc/pam.d/system-auth
+
+  # himmelblau-selinux builds and loads its module in %posttrans, which does
+  # nothing in a compose; do it here.
+  - |
+    #!/usr/bin/env bash
+    set -xeuo pipefail
+    tmp="$(mktemp -d)"
+    cp /usr/share/selinux/packages/himmelblaud/himmelblaud.{te,if,fc} "${tmp}/"
+    make -C "${tmp}" -f /usr/share/selinux/devel/Makefile himmelblaud.pp
+    semodule -n -i "${tmp}/himmelblaud.pp"
+    rm -rf "${tmp}"
+
+  # Show the QR greeter on the GDM login screen, not only in user sessions.
+  - |
+    #!/usr/bin/env bash
+    set -xeuo pipefail
+    install -d /etc/dconf/db/gdm.d
+    cat > /etc/dconf/db/gdm.d/01-himmelblau-qr-greeter <<'CONF'
+    [org/gnome/shell]
+    enabled-extensions=['qr-greeter@himmelblau-idm.org']
+    CONF
+    dconf update
+
+  # Compliance check (user timer) and broker for every user.
+  - |
+    #!/usr/bin/env bash
+    set -xeuo pipefail
+    systemctl --user --global preset-all

images/fedora-intune-himmelblau/manifest.yaml

@@ -0,0 +1,37 @@
+# Minimal GNOME workstation where users sign in with their Entra ID account
+# (Himmelblau), with Microsoft Edge and Microsoft Defender for Endpoint.
+# Himmelblau joins the device to Entra ID at the first sign-in and, with
+# apply_policy, enrolls it in Intune and reports compliance itself, so the
+# Microsoft Intune app (fedora-intune) is not included.
+
+metadata:
+  summary: Fedora minimal GNOME workstation with Entra ID sign-in (Himmelblau)
+
+variables:
+  # Opt out of the upstream fedora.yaml so we don't pull the Firefox RPM.
+  distro: "fedora-intune-himmelblau"
+  variant: "intune-himmelblau"
+
+# Keep it small: no weak/optional dependencies.
+recommends: false
+
+default_target: graphical.target
+
+ref: fedora-intune-himmelblau/${releasever_ref}/${basearch}/intune-himmelblau
+
+# /opt as a plain directory; see fedora-intune/manifest.yaml.
+opt-usrlocal: root
+
+repos:
+  - himmelblau
+  - microsoft-rhel10
+  - microsoft-edge
+
+include:
+  - base-atomic.yaml
+  # Shared with fedora-intune (images/shared).
+  - workstation.yaml
+  - microsoft-edge.yaml
+  - defender.yaml
+  # Entra ID sign-in and Intune.
+  - himmelblau.yaml

images/fedora-intune-himmelblau/repos/himmelblau.repo

@@ -0,0 +1,9 @@
+# Himmelblau Community Nightly packages (free development builds). The
+# maintained Stable repositories need a subscription entitlement token:
+# https://himmelblau-idm.org/stable-repositories/
+[himmelblau]
+name=Himmelblau Community Nightly (Fedora 44)
+baseurl=https://packages.himmelblau-idm.org/nightly/latest/rpm/fedora44
+enabled=1
+gpgcheck=1
+gpgkey=https://packages.himmelblau-idm.org/himmelblau.asc