fedora-intune: minimal GNOME workstation with Intune and Defender

New image for testing Microsoft Intune enrollment and Linux compliance
policies: a minimal GNOME workstation (gnome-initial-setup, Ptyxis,
Files) with the Intune app, the Microsoft identity broker, Edge and
Defender for Endpoint (mdatp) from packages.microsoft.com (RHEL 10
builds, limited to those packages with includepkgs).

No Kanidm: the Intune app installs its own authselect profile with
pam_intune for the password compliance checks. Its %post cannot select
the profile or load the SELinux module during a compose, so both are
redone in postprocess.

build.sh now copies every *.yaml of an image, so manifests can be split
into more files than manifest.yaml and custom.yaml.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

images/fedora-intune/files/10-intune-sshd.conf

@@ -0,0 +1,6 @@
+# Key-only SSH for local accounts (add keys to ~/.ssh/authorized_keys).
+PubkeyAuthentication yes
+PermitRootLogin no
+PasswordAuthentication no
+PermitEmptyPasswords no
+KbdInteractiveAuthentication no

images/fedora-intune/files/50-defender.preset

@@ -0,0 +1,3 @@
+# Defender daemon and its network filter (socket-activated).
+enable mdatp.service
+enable mde_netfilter_v2.socket

images/fedora-intune/files/50-intune.preset

@@ -0,0 +1,3 @@
+# Intune daemon (socket-activated) and the device identity broker.
+enable intune-daemon.socket
+enable microsoft-identity-device-broker.service

images/fedora-intune/files/50-workstation.preset

@@ -0,0 +1,3 @@
+enable gdm.service
+enable qemu-guest-agent.service
+enable sshd.service