fedora-remote: minimal headless GNOME Remote Desktop host with Kanidm

New image built from upstream base-atomic (no desktop), adding only gnome-shell
+ gdm + gnome-remote-desktop + pipewire/portal + foot + Flatpak + Kanidm.
recommends=false to stay lean. Configures GNOME Remote Desktop headless remote
login on first boot (TLS + credentials + enable). Firefox preinstalled as a
per-user Flatpak. Add it to the CI matrix and prune both images.

images/fedora-remote/manifest.yaml

@@ -0,0 +1,29 @@
+# Minimal headless remote host: GNOME Remote Desktop (RDP over Wayland) with
+# Kanidm Unix authentication. Built on the upstream base-atomic (no desktop)
+# manifest, not the full GNOME/silverblue set.
+
+metadata:
+  summary: Fedora headless remote host (GNOME Remote Desktop + Kanidm)
+
+variables:
+  # Opt out of the upstream fedora.yaml so we don't pull the Firefox RPM.
+  distro: "fedora-remote"
+  variant: "remote"
+
+# Keep it small: no weak/optional dependencies.
+recommends: false
+
+default_target: graphical.target
+
+ref: fedora-remote/${releasever_ref}/${basearch}/remote
+
+repos:
+  # Kanidm packages (OBS network:idm).
+  - network_idm
+
+include:
+  - base-atomic.yaml
+  - custom.yaml
+  # Generated by build.sh.
+  - hardware-exclude.yaml
+  - kanidm-token.yaml