fedora-intune: report full image version to Intune, Defender compliance script

Himmelblau reports VERSION_ID from /etc/os-release as the device OS version,
so Intune showed "44". Give himmelblaud and himmelblaud-tasks their own
os-release (bind-mounted in their mount namespace only) with VERSION_ID set to
OSTREE_VERSION, e.g. 44.20261019.0. The rest of the system keeps the stock
VERSION_ID that toolbox, flatpak and dnf expect.

Add an Intune custom compliance discovery script and rules for Microsoft
Defender for Endpoint (installed, running, onboarded, licensed, healthy,
real-time protection, definitions up to date). These are uploaded to Intune,
not shipped in the image.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

images/fedora-intune/files/himmelblau-os-release

@@ -0,0 +1,23 @@
+#!/usr/bin/env bash
+# Write the os-release that the Himmelblau daemons see (10-os-release.conf):
+# the image's /usr/lib/os-release with VERSION_ID set to the full image version
+# (OSTREE_VERSION, e.g. 44.20261019.0), so Intune shows the build and not just
+# "44". Himmelblau reports VERSION_ID as the device's OS version and has no
+# setting for it. The rest of the system keeps the stock VERSION_ID, which
+# toolbox, flatpak and dnf expect to be the plain release.
+set -euo pipefail
+
+SRC=/usr/lib/os-release
+DEST=/run/himmelblau-os-release
+
+version="$(. "${SRC}" && echo "${OSTREE_VERSION:-${IMAGE_VERSION:-}}")"
+
+tmp="$(mktemp "${DEST}.XXXXXX")"
+if [[ -n "${version}" ]]; then
+  sed "s/^VERSION_ID=.*/VERSION_ID=${version}/" "${SRC}" > "${tmp}"
+else
+  # No image version (not an ostree/bootc deployment): pass it through as-is.
+  cat "${SRC}" > "${tmp}"
+fi
+chmod 0644 "${tmp}"
+mv -f "${tmp}" "${DEST}"