fedora-intune: report full image version to Intune, Defender compliance script

Himmelblau reports VERSION_ID from /etc/os-release as the device OS version,
so Intune showed "44". Give himmelblaud and himmelblaud-tasks their own
os-release (bind-mounted in their mount namespace only) with VERSION_ID set to
OSTREE_VERSION, e.g. 44.20261019.0. The rest of the system keeps the stock
VERSION_ID that toolbox, flatpak and dnf expect.

Add an Intune custom compliance discovery script and rules for Microsoft
Defender for Endpoint (installed, running, onboarded, licensed, healthy,
real-time protection, definitions up to date). These are uploaded to Intune,
not shipped in the image.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

images/fedora-intune/intune/defender-compliance.sh

@@ -0,0 +1,64 @@
+#!/bin/bash
+# Intune custom compliance discovery script for Linux: is Microsoft Defender
+# for Endpoint (mdatp) installed, onboarded, licensed and protecting?
+#
+# Upload in Intune > Devices > Compliance > Scripts (Linux), and pair it with
+# defender-compliance.json in a Linux compliance policy (Custom compliance).
+# Himmelblau runs it as root inside himmelblaud-tasks.service and sends the
+# JSON on stdout to Intune, which evaluates it against the rules. Every setting
+# is always emitted, so a missing or stopped Defender reads as non-compliant
+# instead of as a script error.
+
+MDATP=/usr/bin/mdatp
+
+# Print one `mdatp health` field without quotes or a trailing " [managed]".
+# Unlicensed or unonboarded, mdatp prints "ATTENTION: ..." lines first.
+field() {
+  "${MDATP}" health --field "$1" 2>/dev/null | grep -v '^ATTENTION' | tail -n1 \
+    | sed -e 's/ \[managed\]$//' -e 's/^"//' -e 's/"$//'
+}
+
+bool() {
+  [[ "$1" == true ]] && echo true || echo false
+}
+
+installed=false
+running=false
+healthy=false
+licensed=false
+onboarded=false
+rtp=false
+definitions_ok=false
+definitions_age=-1
+version=""
+
+if [[ -x "${MDATP}" ]]; then
+  installed=true
+  if [[ "$(field healthy)" =~ ^(true|false)$ ]]; then
+    # The daemon answered.
+    running=true
+    healthy="$(bool "$(field healthy)")"
+    licensed="$(bool "$(field licensed)")"
+    rtp="$(bool "$(field real_time_protection_enabled)")"
+    [[ -n "$(field org_id)" ]] && onboarded=true
+    [[ "$(field definitions_status)" == up_to_date ]] && definitions_ok=true
+    age="$(field definitions_updated_minutes_ago)"
+    [[ "${age}" =~ ^[0-9]+$ ]] && definitions_age=$(( age / 1440 ))
+    version="$(field app_version)"
+    version="${version//[^0-9A-Za-z._-]/}"
+  fi
+fi
+
+cat <<EOF
+{
+  "DefenderInstalled": ${installed},
+  "DefenderRunning": ${running},
+  "DefenderHealthy": ${healthy},
+  "DefenderLicensed": ${licensed},
+  "DefenderOnboarded": ${onboarded},
+  "DefenderRealTimeProtection": ${rtp},
+  "DefenderDefinitionsUpToDate": ${definitions_ok},
+  "DefenderDefinitionsAgeDays": ${definitions_age},
+  "DefenderVersion": "${version}"
+}
+EOF