fedora-intune: use Himmelblau instead of the Microsoft Intune app

Go with Entra ID sign-in through Himmelblau for fedora-intune and drop
the Microsoft Intune app (intune-portal, identity broker) variant. With
a single image, the workstation, Edge and Defender manifests move back
from images/shared into images/fedora-intune, and CI builds just that
image again. The Microsoft repo is now limited to mdatp and Edge.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

images/fedora-intune/himmelblau.yaml

@@ -0,0 +1,68 @@
+# Himmelblau: Entra ID sign-in (PAM/NSS), Entra join, Hello PIN, Intune
+# enrollment and compliance, and browser SSO.
+
+repo-packages:
+  - repo: himmelblau
+    packages:
+      - himmelblau
+      - pam-himmelblau
+      - nss-himmelblau
+      - himmelblau-selinux
+      # Shows a QR code on the login screen for the MFA/device-code prompts.
+      - himmelblau-qr-greeter
+      # Entra SSO in Edge (native messaging host) via the Himmelblau broker.
+      - himmelblau-broker
+      - himmelblau-sso
+
+packages:
+  - authselect
+  - nss-altfiles
+  # himmelblau-selinux compiles its policy module at install time.
+  - make
+  - selinux-policy-devel
+
+add-files:
+  - ["himmelblau.conf", "/etc/himmelblau/himmelblau.conf"]
+  - ["50-himmelblau.preset", "/usr/lib/systemd/system-preset/50-himmelblau.preset"]
+  - ["50-himmelblau-user.preset", "/usr/lib/systemd/user-preset/50-himmelblau-user.preset"]
+
+postprocess:
+  # The package's %post selects its authselect vendor profile but drops
+  # with-altfiles; without it system users (gdm, pipewire, mdatp, ...) in
+  # /usr/lib/passwd do not resolve and the login screen never starts.
+  - |
+    #!/usr/bin/env bash
+    set -xeuo pipefail
+    authselect select himmelblau with-altfiles with-pam-gnome-keyring --force --nobackup
+    for user in gdm mdatp; do
+      getent passwd "${user}" >/dev/null
+    done
+    grep -q pam_himmelblau.so /etc/pam.d/system-auth
+
+  # himmelblau-selinux builds and loads its module in %posttrans, which does
+  # nothing in a compose; do it here.
+  - |
+    #!/usr/bin/env bash
+    set -xeuo pipefail
+    tmp="$(mktemp -d)"
+    cp /usr/share/selinux/packages/himmelblaud/himmelblaud.{te,if,fc} "${tmp}/"
+    make -C "${tmp}" -f /usr/share/selinux/devel/Makefile himmelblaud.pp
+    semodule -n -i "${tmp}/himmelblaud.pp"
+    rm -rf "${tmp}"
+
+  # Show the QR greeter on the GDM login screen, not only in user sessions.
+  - |
+    #!/usr/bin/env bash
+    set -xeuo pipefail
+    install -d /etc/dconf/db/gdm.d
+    cat > /etc/dconf/db/gdm.d/01-himmelblau-qr-greeter <<'CONF'
+    [org/gnome/shell]
+    enabled-extensions=['qr-greeter@himmelblau-idm.org']
+    CONF
+    dconf update
+
+  # Compliance check (user timer) and broker for every user.
+  - |
+    #!/usr/bin/env bash
+    set -xeuo pipefail
+    systemctl --user --global preset-all