fedora-intune: fix boot issues, add Himmelblau variant

Fixes found by building and inspecting the image:

- Select the Intune authselect profile with-altfiles. Without it system
  users in /usr/lib/passwd (gdm, pipewire, mdatp) do not resolve and the
  login screen never starts. The build now fails if gdm does not resolve.
- Ship /opt as a plain directory (opt-usrlocal: root). Defender installs
  to /opt/microsoft/mdatp and keeps state in /var/opt/microsoft/mdatp;
  with the default /opt -> /var/opt symlink those were the same
  read-only directory. rpm-ostree still relocates /opt content to
  /usr/lib/opt, so finalize.d/60-opt-links links it back (only for images
  where /opt is a directory; fedora-cosmic/remote are unaffected).
- Run Defender's %post on first boot (mdatp-firstboot.service): in a
  compose /var is read-only and the machine GUID/state must not be
  shared. mdatp.service waits for it.

New image fedora-intune-himmelblau: the same workstation with Entra ID
sign-in through Himmelblau (Community Nightly packages), which joins the
device at the first sign-in and enrolls it in Intune (apply_policy)
instead of the Microsoft Intune app. Workstation, Edge and Defender
manifests move to images/shared so both images use them; build.sh copies
images/shared/*.yaml and CI builds both images in one matrix job.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

images/fedora-intune-himmelblau/manifest.yaml

@@ -0,0 +1,37 @@
+# Minimal GNOME workstation where users sign in with their Entra ID account
+# (Himmelblau), with Microsoft Edge and Microsoft Defender for Endpoint.
+# Himmelblau joins the device to Entra ID at the first sign-in and, with
+# apply_policy, enrolls it in Intune and reports compliance itself, so the
+# Microsoft Intune app (fedora-intune) is not included.
+
+metadata:
+  summary: Fedora minimal GNOME workstation with Entra ID sign-in (Himmelblau)
+
+variables:
+  # Opt out of the upstream fedora.yaml so we don't pull the Firefox RPM.
+  distro: "fedora-intune-himmelblau"
+  variant: "intune-himmelblau"
+
+# Keep it small: no weak/optional dependencies.
+recommends: false
+
+default_target: graphical.target
+
+ref: fedora-intune-himmelblau/${releasever_ref}/${basearch}/intune-himmelblau
+
+# /opt as a plain directory; see fedora-intune/manifest.yaml.
+opt-usrlocal: root
+
+repos:
+  - himmelblau
+  - microsoft-rhel10
+  - microsoft-edge
+
+include:
+  - base-atomic.yaml
+  # Shared with fedora-intune (images/shared).
+  - workstation.yaml
+  - microsoft-edge.yaml
+  - defender.yaml
+  # Entra ID sign-in and Intune.
+  - himmelblau.yaml