fedora-remote: minimal headless GNOME Remote Desktop host with Kanidm

New image built from upstream base-atomic (no desktop), adding only gnome-shell
+ gdm + gnome-remote-desktop + pipewire/portal + foot + Flatpak + Kanidm.
recommends=false to stay lean. Configures GNOME Remote Desktop headless remote
login on first boot (TLS + credentials + enable). Firefox preinstalled as a
per-user Flatpak. Add it to the CI matrix and prune both images.

images/fedora-remote/files/kanidm-unixd.cil

@@ -0,0 +1,21 @@
+; Kanidm ships no SELinux policy. Without these allows, nss/pam consumers
+; (sshd, the display manager, systemd-userdbd, ...) are denied write access to
+; the kanidm-unixd sockets in /run/kanidm-unixd (labeled var_run_t), so Kanidm
+; users cannot be resolved or authenticated and logins fail (sshd reports
+; "invalid user"). This is the allow set produced by:
+;   grep avc: /var/log/audit/audit.log | audit2allow
+(allow accountsd_t var_run_t (sock_file (write)))
+(allow auditd_t var_run_t (sock_file (write)))
+(allow chkpwd_t var_run_t (sock_file (write)))
+(allow local_login_t var_run_t (sock_file (write)))
+(allow policykit_t var_run_t (sock_file (write)))
+(allow ssh_keygen_t var_run_t (sock_file (write)))
+(allow sshd_auth_t var_run_t (sock_file (write)))
+(allow sshd_keygen_t var_run_t (sock_file (write)))
+(allow sshd_session_t var_run_t (sock_file (write)))
+(allow sshd_t var_run_t (sock_file (write)))
+(allow systemd_bootc_generator_t var_run_t (sock_file (write)))
+(allow systemd_selinux_autorelabel_generator_t var_run_t (sock_file (write)))
+(allow systemd_userdbd_t var_run_t (sock_file (write)))
+(allow xdm_t var_run_t (sock_file (write)))
+(allow init_t unconfined_service_t (unix_stream_socket (connectto)))