fedora-intune: report full image version to Intune, Defender compliance script

Himmelblau reports VERSION_ID from /etc/os-release as the device OS version,
so Intune showed "44". Give himmelblaud and himmelblaud-tasks their own
os-release (bind-mounted in their mount namespace only) with VERSION_ID set to
OSTREE_VERSION, e.g. 44.20261019.0. The rest of the system keeps the stock
VERSION_ID that toolbox, flatpak and dnf expect.

Add an Intune custom compliance discovery script and rules for Microsoft
Defender for Endpoint (installed, running, onboarded, licensed, healthy,
real-time protection, definitions up to date). These are uploaded to Intune,
not shipped in the image.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

images/fedora-intune/himmelblau.yaml

@@ -25,6 +25,11 @@ add-files:
   - ["himmelblau.conf", "/etc/himmelblau/himmelblau.conf"]
   - ["50-himmelblau.preset", "/usr/lib/systemd/system-preset/50-himmelblau.preset"]
   - ["50-himmelblau-user.preset", "/usr/lib/systemd/user-preset/50-himmelblau-user.preset"]
+  # Report the full image version (44.20261019.0) as the OS version in Intune.
+  - ["himmelblau-os-release", "/usr/libexec/himmelblau-os-release"]
+  - ["himmelblau-os-release.service", "/usr/lib/systemd/system/himmelblau-os-release.service"]
+  - ["10-himmelblau-os-release.conf", "/usr/lib/systemd/system/himmelblaud.service.d/10-os-release.conf"]
+  - ["10-himmelblau-os-release.conf", "/usr/lib/systemd/system/himmelblaud-tasks.service.d/10-os-release.conf"]
 
 postprocess:
   # The package's %post selects its authselect vendor profile but drops
@@ -38,6 +43,7 @@ postprocess:
       getent passwd "${user}" >/dev/null
     done
     grep -q pam_himmelblau.so /etc/pam.d/system-auth
+    chmod 0755 /usr/libexec/himmelblau-os-release
 
   # himmelblau-selinux builds and loads its module in %posttrans, which does
   # nothing in a compose; do it here.