fedora-remote: minimal headless GNOME Remote Desktop host with Kanidm

New image built from upstream base-atomic (no desktop), adding only gnome-shell
+ gdm + gnome-remote-desktop + pipewire/portal + foot + Flatpak + Kanidm.
recommends=false to stay lean. Configures GNOME Remote Desktop headless remote
login on first boot (TLS + credentials + enable). Firefox preinstalled as a
per-user Flatpak. Add it to the CI matrix and prune both images.

images/fedora-remote/files/flatpak-user-firstboot.service

@@ -0,0 +1,14 @@
+[Unit]
+Description=Install per-user Flatpak applications on first login
+Documentation=https://docs.flatpak.org/en/latest/flatpak-command-reference.html
+ConditionPathExists=!%h/.config/flatpak-user-firstboot.done
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=oneshot
+RemainAfterExit=yes
+ExecStart=/usr/libexec/flatpak-user-firstboot
+
+[Install]
+WantedBy=default.target