fedora-intune: use Himmelblau instead of the Microsoft Intune app

Go with Entra ID sign-in through Himmelblau for fedora-intune and drop
the Microsoft Intune app (intune-portal, identity broker) variant. With
a single image, the workstation, Edge and Defender manifests move back
from images/shared into images/fedora-intune, and CI builds just that
image again. The Microsoft repo is now limited to mdatp and Edge.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

images/fedora-intune/manifest.yaml

@@ -1,10 +1,10 @@
-# Minimal GNOME workstation with the Microsoft Intune app, Microsoft Edge and
-# Microsoft Defender for Endpoint, for testing Intune enrollment and Linux
-# compliance policies. Local accounts only: no Kanidm, because the Intune app
-# needs its own authselect profile (pam_intune) for the password checks.
+# Minimal GNOME workstation where users sign in with their Entra ID account
+# (Himmelblau), with Microsoft Edge and Microsoft Defender for Endpoint.
+# Himmelblau joins the device to Entra ID at the first sign-in and, with
+# apply_policy, enrolls it in Intune and reports compliance.
 
 metadata:
-  summary: Fedora minimal GNOME workstation with Microsoft Intune and Defender
+  summary: Fedora minimal GNOME workstation with Entra ID sign-in and Intune
 
 variables:
   # Opt out of the upstream fedora.yaml so we don't pull the Firefox RPM.
@@ -21,18 +21,19 @@ ref: fedora-intune/${releasever_ref}/${basearch}/intune
 # Ship /opt as a plain read-only directory instead of a symlink to /var/opt.
 # Defender installs to /opt/microsoft/mdatp and keeps its state in
 # /var/opt/microsoft/mdatp; with the default symlink those are the same,
-# read-only directory. Needs composefs, which upstream enables.
+# read-only directory. Needs composefs, which upstream enables. The vendor
+# directories are linked into /opt by finalize.d/60-opt-links.
 opt-usrlocal: root
 
 repos:
+  - himmelblau
   - microsoft-rhel10
   - microsoft-edge
 
 include:
   - base-atomic.yaml
-  # Shared with fedora-intune-himmelblau (images/shared).
-  - workstation.yaml
+  - custom.yaml
+  # Entra ID sign-in and Intune.
+  - himmelblau.yaml
   - microsoft-edge.yaml
   - defender.yaml
-  # Microsoft Intune app.
-  - intune.yaml