fedora-intune: use Himmelblau instead of the Microsoft Intune app

Go with Entra ID sign-in through Himmelblau for fedora-intune and drop
the Microsoft Intune app (intune-portal, identity broker) variant. With
a single image, the workstation, Edge and Defender manifests move back
from images/shared into images/fedora-intune, and CI builds just that
image again. The Microsoft repo is now limited to mdatp and Edge.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

images/fedora-intune/defender.yaml

@@ -0,0 +1,46 @@
+# Microsoft Defender for Endpoint on Linux (mdatp), RHEL 10 build, from the
+# microsoft-rhel10 repo (repos/microsoft.repo).
+#
+# mdatp's %post does the real install: units, SELinux module, and per-machine
+# state under /var/opt/microsoft/mdatp (machine GUID, definitions database,
+# logs). In a compose /var is read-only, and that state must not be shared
+# between machines anyway, so the %post is saved into the image and run once on
+# first boot by mdatp-firstboot.service. mdatp.service waits for it.
+#
+# Onboarding is per tenant and not part of the image: run the onboarding script
+# from the Defender portal on the device.
+
+repo-packages:
+  - repo: microsoft-rhel10
+    packages:
+      - mdatp
+
+packages:
+  # The %post is a bash script; Defender's inventory scripts and the
+  # onboarding script are Python.
+  - bash
+  - python3
+
+add-files:
+  - ["mdatp-firstboot", "/usr/libexec/mdatp-firstboot"]
+  - ["mdatp-firstboot.service", "/usr/lib/systemd/system/mdatp-firstboot.service"]
+  - ["mdatp-firstboot.conf", "/usr/lib/systemd/system/mdatp.service.d/10-firstboot.conf"]
+  - ["50-defender.preset", "/usr/lib/systemd/system-preset/50-defender.preset"]
+
+postprocess:
+  - |
+    #!/usr/bin/env bash
+    set -xeuo pipefail
+    # The %post wrote the units during the compose; fail the build if a newer
+    # mdatp stops doing that, rather than shipping a Defender that never starts.
+    for unit in mdatp.service mde_netfilter_v2.service mde_netfilter_v2.socket; do
+      test -f "/usr/lib/systemd/system/${unit}"
+    done
+    # rpm-ostree keeps /opt content in /usr/lib/opt until the commit.
+    for root in /usr/lib/opt /opt; do
+      pp="${root}/microsoft/mdatp/conf/selinux_policies/out/mdatp_service.pp"
+      [[ -f "${pp}" ]] && break
+    done
+    semodule -n -i "${pp}"
+    rpm -q --qf '%{POSTIN}' mdatp > /usr/libexec/mdatp-postinst
+    chmod 0755 /usr/libexec/mdatp-firstboot /usr/libexec/mdatp-postinst