fedora-intune: minimal GNOME workstation with Intune and Defender

New image for testing Microsoft Intune enrollment and Linux compliance
policies: a minimal GNOME workstation (gnome-initial-setup, Ptyxis,
Files) with the Intune app, the Microsoft identity broker, Edge and
Defender for Endpoint (mdatp) from packages.microsoft.com (RHEL 10
builds, limited to those packages with includepkgs).

No Kanidm: the Intune app installs its own authselect profile with
pam_intune for the password compliance checks. Its %post cannot select
the profile or load the SELinux module during a compose, so both are
redone in postprocess.

build.sh now copies every *.yaml of an image, so manifests can be split
into more files than manifest.yaml and custom.yaml.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

build.sh

@@ -191,8 +191,7 @@ case "${BUILD_MODE}" in
 
     # Overlay our manifests/support files into the upstream tree so that
     # relative includes and *.repo discovery keep working.
-    cp "${IMAGE_DIR}/manifest.yaml" "${BUILD_DIR}/upstream/"
-    cp "${IMAGE_DIR}/custom.yaml" "${BUILD_DIR}/upstream/"
+    cp "${IMAGE_DIR}"/*.yaml "${BUILD_DIR}/upstream/"
     if compgen -G "${IMAGE_DIR}/repos/*.repo" >/dev/null; then
       cp "${IMAGE_DIR}"/repos/*.repo "${BUILD_DIR}/upstream/"
     fi