fedora-intune: use Himmelblau instead of the Microsoft Intune app

Go with Entra ID sign-in through Himmelblau for fedora-intune and drop
the Microsoft Intune app (intune-portal, identity broker) variant. With
a single image, the workstation, Edge and Defender manifests move back
from images/shared into images/fedora-intune, and CI builds just that
image again. The Microsoft repo is now limited to mdatp and Edge.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

images/fedora-intune/custom.yaml

@@ -0,0 +1,55 @@
+# Minimal GNOME workstation.
+
+packages:
+  # Fedora integration normally provided by the upstream fedora.yaml (which we
+  # opt out of to avoid the Firefox RPM).
+  - fedora-release
+  - fedora-release-ostree-desktop
+  - fedora-flathub-remote
+
+  # GNOME desktop: gdm pulls gnome-session, gnome-settings-daemon,
+  # accountsservice, dconf and gnome-keyring-pam. gnome-initial-setup creates
+  # the first local user on first boot.
+  - gdm
+  - gnome-shell
+  - gnome-control-center
+  - gnome-initial-setup
+  - nautilus
+  - ptyxis
+  - pipewire
+  - pipewire-pulseaudio
+  - wireplumber
+  - xdg-desktop-portal-gnome
+  - xdg-user-dirs-gtk
+  - flatpak
+
+  # Session infrastructure base-atomic lacks with recommends off; see
+  # fedora-remote/custom.yaml.
+  - dbus-daemon
+  - systemd-pam
+  - mesa-dri-drivers
+  - mesa-libEGL
+
+  # The upstream initramfs config adds dracut's tpm2-tss module, which needs the
+  # tpm2 binary. fedora-remote gets it through Kanidm; list it explicitly here.
+  - tpm2-tools
+
+  # Proxmox guest integration (agent, console clipboard and resizing).
+  - qemu-guest-agent
+  - spice-vdagent
+
+# Microsoft Edge is the browser (Conditional Access needs it).
+exclude-packages:
+  - firefox
+
+add-files:
+  - ["50-workstation.preset", "/usr/lib/systemd/system-preset/50-workstation.preset"]
+  # Key-only SSH for local accounts.
+  - ["10-workstation-sshd.conf", "/etc/ssh/sshd_config.d/10-workstation-sshd.conf"]
+
+postprocess:
+  # uresourced breaks the GDM greeter's user manager; see fedora-remote.
+  - |
+    #!/usr/bin/env bash
+    set -xeuo pipefail
+    ln -sf /dev/null /etc/systemd/system/uresourced.service