fedora-intune: cron for Intune config scripts, Defender remediation script

Himmelblau installs Intune Linux custom configuration scripts as
/etc/cron.d jobs, and the image had no cron, so a script policy failed to
apply. Add cronie and enable crond.

Add a custom configuration script that repairs Microsoft Defender on its
schedule: finishes first-boot setup, restarts a stopped daemon, onboards with
the tenant's mdatp_onboard.json (pasted into the script in Intune), and
re-enables real-time protection and updates definitions when needed.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

images/fedora-intune/himmelblau.yaml

@@ -20,6 +20,8 @@ packages:
   # himmelblau-selinux compiles its policy module at install time.
   - make
   - selinux-policy-devel
+  # Intune custom configuration scripts are installed as /etc/cron.d jobs.
+  - cronie
 
 add-files:
   - ["himmelblau.conf", "/etc/himmelblau/himmelblau.conf"]
@@ -44,6 +46,7 @@ postprocess:
     done
     grep -q pam_himmelblau.so /etc/pam.d/system-auth
     chmod 0755 /usr/libexec/himmelblau-os-release
+    test -d /etc/cron.d
 
   # himmelblau-selinux builds and loads its module in %posttrans, which does
   # nothing in a compose; do it here.