fedora-intune: minimal GNOME workstation with Intune and Defender

New image for testing Microsoft Intune enrollment and Linux compliance
policies: a minimal GNOME workstation (gnome-initial-setup, Ptyxis,
Files) with the Intune app, the Microsoft identity broker, Edge and
Defender for Endpoint (mdatp) from packages.microsoft.com (RHEL 10
builds, limited to those packages with includepkgs).

No Kanidm: the Intune app installs its own authselect profile with
pam_intune for the password compliance checks. Its %post cannot select
the profile or load the SELinux module during a compose, so both are
redone in postprocess.

build.sh now copies every *.yaml of an image, so manifests can be split
into more files than manifest.yaml and custom.yaml.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

images/fedora-intune/defender.yaml

@@ -0,0 +1,39 @@
+# Microsoft Defender for Endpoint on Linux (mdatp), RHEL 10 build.
+#
+# mdatp's %post does the real install: it writes mdatp.service and the
+# mde_netfilter_v2 units, loads its SELinux module and creates a machine GUID
+# and state under /var/opt/microsoft/mdatp. In a compose the daemon cannot
+# start and /var is not shipped, so the units and SELinux module are handled
+# here and the per-machine state is left to the first start on the device.
+#
+# Onboarding is per tenant and not part of the image: run the onboarding script
+# from the Defender portal on the device (see the Intune test doc).
+
+repo-packages:
+  - repo: microsoft-rhel10
+    packages:
+      - mdatp
+
+packages:
+  # Used by the Defender TVM/inventory scripts and the onboarding script.
+  - python3
+
+add-files:
+  - ["50-defender.preset", "/usr/lib/systemd/system-preset/50-defender.preset"]
+
+postprocess:
+  - |
+    #!/usr/bin/env bash
+    set -xeuo pipefail
+    conf=/opt/microsoft/mdatp/conf
+    # Units the %post copies into place; install them if it did not get there.
+    for unit in mdatp.service mde_netfilter_v2.service mde_netfilter_v2.socket; do
+      if [[ ! -f "/usr/lib/systemd/system/${unit}" ]]; then
+        install -m 0644 "${conf}/${unit}" "/usr/lib/systemd/system/${unit}"
+      fi
+    done
+    semodule -n -i "${conf}/selinux_policies/out/mdatp_service.pp"
+    # Never ship a machine GUID or onboarding state baked in at build time.
+    ls -laR /etc/opt/microsoft /var/opt/microsoft 2>/dev/null || true
+    rm -rf /var/opt/microsoft/mdatp
+    rm -f /etc/opt/microsoft/mdatp/mdatp_onboard.json