fedora-intune: use Himmelblau instead of the Microsoft Intune app

Go with Entra ID sign-in through Himmelblau for fedora-intune and drop
the Microsoft Intune app (intune-portal, identity broker) variant. With
a single image, the workstation, Edge and Defender manifests move back
from images/shared into images/fedora-intune, and CI builds just that
image again. The Microsoft repo is now limited to mdatp and Edge.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

images/shared/defender.yaml

@@ -1,46 +0,0 @@
-# Microsoft Defender for Endpoint on Linux (mdatp), RHEL 10 build, from the
-# microsoft-rhel10 repo (shared/repos/microsoft.repo).
-#
-# mdatp's %post does the real install: units, SELinux module, and per-machine
-# state under /var/opt/microsoft/mdatp (machine GUID, definitions database,
-# logs). In a compose /var is read-only, and that state must not be shared
-# between machines anyway, so the %post is saved into the image and run once on
-# first boot by mdatp-firstboot.service. mdatp.service waits for it.
-#
-# Onboarding is per tenant and not part of the image: run the onboarding script
-# from the Defender portal on the device.
-
-repo-packages:
-  - repo: microsoft-rhel10
-    packages:
-      - mdatp
-
-packages:
-  # The %post is a bash script; Defender's inventory scripts and the
-  # onboarding script are Python.
-  - bash
-  - python3
-
-add-files:
-  - ["mdatp-firstboot", "/usr/libexec/mdatp-firstboot"]
-  - ["mdatp-firstboot.service", "/usr/lib/systemd/system/mdatp-firstboot.service"]
-  - ["mdatp-firstboot.conf", "/usr/lib/systemd/system/mdatp.service.d/10-firstboot.conf"]
-  - ["50-defender.preset", "/usr/lib/systemd/system-preset/50-defender.preset"]
-
-postprocess:
-  - |
-    #!/usr/bin/env bash
-    set -xeuo pipefail
-    # The %post wrote the units during the compose; fail the build if a newer
-    # mdatp stops doing that, rather than shipping a Defender that never starts.
-    for unit in mdatp.service mde_netfilter_v2.service mde_netfilter_v2.socket; do
-      test -f "/usr/lib/systemd/system/${unit}"
-    done
-    # rpm-ostree keeps /opt content in /usr/lib/opt until the commit.
-    for root in /usr/lib/opt /opt; do
-      pp="${root}/microsoft/mdatp/conf/selinux_policies/out/mdatp_service.pp"
-      [[ -f "${pp}" ]] && break
-    done
-    semodule -n -i "${pp}"
-    rpm -q --qf '%{POSTIN}' mdatp > /usr/libexec/mdatp-postinst
-    chmod 0755 /usr/libexec/mdatp-firstboot /usr/libexec/mdatp-postinst

images/shared/files/10-workstation-sshd.conf

@@ -1,6 +0,0 @@
-# Key-only SSH for local accounts (add keys to ~/.ssh/authorized_keys).
-PubkeyAuthentication yes
-PermitRootLogin no
-PasswordAuthentication no
-PermitEmptyPasswords no
-KbdInteractiveAuthentication no

images/shared/files/50-defender.preset

@@ -1,4 +0,0 @@
-# Defender: first-boot setup, the daemon and its network filter.
-enable mdatp-firstboot.service
-enable mdatp.service
-enable mde_netfilter_v2.socket

images/shared/files/50-workstation.preset

@@ -1,3 +0,0 @@
-enable gdm.service
-enable qemu-guest-agent.service
-enable sshd.service

images/shared/files/mdatp-firstboot

@@ -1,17 +0,0 @@
-#!/usr/bin/env bash
-# Finish the Defender (mdatp) install on first boot by running the package's
-# own %post, saved at build time: it creates the machine GUID, state, logs and
-# definitions database under /var and then enables and starts mdatp.service.
-set -euo pipefail
-
-MARKER=/var/lib/mdatp-firstboot.done
-
-[[ -f "${MARKER}" ]] && exit 0
-
-# mdatp.service only starts once the marker exists (10-firstboot.conf), and the
-# %post starts it, so create the marker first and drop it again on failure.
-touch "${MARKER}"
-if ! bash /usr/libexec/mdatp-postinst 1; then
-  rm -f "${MARKER}"
-  exit 1
-fi

images/shared/files/mdatp-firstboot.conf

@@ -1,3 +0,0 @@
-# Don't start Defender before mdatp-firstboot.service has created its state.
-[Unit]
-ConditionPathExists=/var/lib/mdatp-firstboot.done

images/shared/files/mdatp-firstboot.service

@@ -1,15 +0,0 @@
-[Unit]
-Description=Finish the Microsoft Defender for Endpoint install on first boot
-Documentation=https://learn.microsoft.com/en-us/defender-endpoint/microsoft-defender-endpoint-linux
-After=network-online.target
-Wants=network-online.target
-ConditionPathExists=!/var/lib/mdatp-firstboot.done
-
-[Service]
-Type=oneshot
-ExecStart=/usr/libexec/mdatp-firstboot
-RemainAfterExit=yes
-TimeoutStartSec=15min
-
-[Install]
-WantedBy=multi-user.target

images/shared/microsoft-edge.yaml

@@ -1,7 +0,0 @@
-# Microsoft Edge, from the microsoft-edge repo (shared/repos/microsoft.repo).
-# Conditional Access to Microsoft 365 web apps on Linux requires Edge.
-
-repo-packages:
-  - repo: microsoft-edge
-    packages:
-      - microsoft-edge-stable

images/shared/repos/microsoft.repo

@@ -1,19 +0,0 @@
-# packages.microsoft.com, limited with includepkgs to the packages the images
-# use, so nothing else from the RHEL repo can replace a Fedora package.
-
-[microsoft-rhel10]
-name=Microsoft Production (RHEL 10)
-baseurl=https://packages.microsoft.com/rhel/10/prod/
-enabled=1
-gpgcheck=1
-repo_gpgcheck=1
-gpgkey=https://packages.microsoft.com/keys/microsoft-2025.asc
-includepkgs=intune-portal microsoft-identity-broker mdatp
-
-[microsoft-edge]
-name=Microsoft Edge
-baseurl=https://packages.microsoft.com/yumrepos/edge/
-enabled=1
-gpgcheck=1
-gpgkey=https://packages.microsoft.com/keys/microsoft.asc
-includepkgs=microsoft-edge-stable

images/shared/workstation.yaml

@@ -1,56 +0,0 @@
-# Minimal GNOME workstation, shared by the fedora-intune images. Include it
-# from a manifest that sets `opt-usrlocal: root` (finalize.d/60-opt-links).
-
-packages:
-  # Fedora integration normally provided by the upstream fedora.yaml (which we
-  # opt out of to avoid the Firefox RPM).
-  - fedora-release
-  - fedora-release-ostree-desktop
-  - fedora-flathub-remote
-
-  # GNOME desktop: gdm pulls gnome-session, gnome-settings-daemon,
-  # accountsservice, dconf and gnome-keyring-pam. gnome-initial-setup creates
-  # the first local user on first boot.
-  - gdm
-  - gnome-shell
-  - gnome-control-center
-  - gnome-initial-setup
-  - nautilus
-  - ptyxis
-  - pipewire
-  - pipewire-pulseaudio
-  - wireplumber
-  - xdg-desktop-portal-gnome
-  - xdg-user-dirs-gtk
-  - flatpak
-
-  # Session infrastructure base-atomic lacks with recommends off; see
-  # fedora-remote/custom.yaml.
-  - dbus-daemon
-  - systemd-pam
-  - mesa-dri-drivers
-  - mesa-libEGL
-
-  # The upstream initramfs config adds dracut's tpm2-tss module, which needs the
-  # tpm2 binary. fedora-remote gets it through Kanidm; list it explicitly here.
-  - tpm2-tools
-
-  # Proxmox guest integration (agent, console clipboard and resizing).
-  - qemu-guest-agent
-  - spice-vdagent
-
-# Microsoft Edge is the browser (Conditional Access needs it).
-exclude-packages:
-  - firefox
-
-add-files:
-  - ["50-workstation.preset", "/usr/lib/systemd/system-preset/50-workstation.preset"]
-  # Key-only SSH for local accounts.
-  - ["10-workstation-sshd.conf", "/etc/ssh/sshd_config.d/10-workstation-sshd.conf"]
-
-postprocess:
-  # uresourced breaks the GDM greeter's user manager; see fedora-remote.
-  - |
-    #!/usr/bin/env bash
-    set -xeuo pipefail
-    ln -sf /dev/null /etc/systemd/system/uresourced.service