fedora-remote: minimal headless GNOME Remote Desktop host with Kanidm

New image built from upstream base-atomic (no desktop), adding only gnome-shell
+ gdm + gnome-remote-desktop + pipewire/portal + foot + Flatpak + Kanidm.
recommends=false to stay lean. Configures GNOME Remote Desktop headless remote
login on first boot (TLS + credentials + enable). Firefox preinstalled as a
per-user Flatpak. Add it to the CI matrix and prune both images.

images/fedora-remote/upstream-exclude.txt

@@ -0,0 +1,49 @@
+# Packages removed from the cloned upstream manifests at build time.
+#
+# rpm-ostree treats excluding a package that an included manifest declares as a
+# fatal error, so build.sh strips these lines from the upstream package
+# manifests before composing.
+#
+# Target machine: GMKtec NucBox M7
+#   - AMD Ryzen 7 PRO 6850H (Radeon 680M iGPU)   -> amd-gpu-firmware kept
+#   - 2x Intel I226-V Ethernet                    -> kernel driver, no fw pkg
+#   - Intel Wi-Fi 6 AX200                         -> iwlwifi-mvm-firmware kept
+#   - AMD audio (SOF)                             -> alsa-sof-firmware kept
+# No NVIDIA, no Intel GPU/audio, no other wireless vendors, bare metal (no VMs).
+
+# NVIDIA
+nvidia-gpu-firmware
+
+# Intel GPU / platform / audio (Intel wireless firmware is kept below)
+intel-gpu-firmware
+intel-audio-firmware
+intel-lpmd
+intel-vsc-firmware
+libva-intel-media-driver
+
+# Intel-only CPU tooling (AMD uses amd-ucode-firmware)
+microcode_ctl
+thermald
+
+# Wireless firmware for hardware that is not present
+atheros-firmware
+brcmfmac-firmware
+libertas-firmware
+mt7xxx-firmware
+nxpwireless-firmware
+qcom-wwan-firmware
+realtek-firmware
+tiwilink-firmware
+iwlwifi-dvm-firmware
+iwlegacy-firmware
+
+# Audio firmware for other vendors
+cirrus-audio-firmware
+
+# Virtual machine guest agents / drivers
+hyperv-daemons
+open-vm-tools-desktop
+qemu-guest-agent
+spice-vdagent
+spice-webdavd
+virtualbox-guest-additions