fedora-intune: use Himmelblau instead of the Microsoft Intune app

Go with Entra ID sign-in through Himmelblau for fedora-intune and drop
the Microsoft Intune app (intune-portal, identity broker) variant. With
a single image, the workstation, Edge and Defender manifests move back
from images/shared into images/fedora-intune, and CI builds just that
image again. The Microsoft repo is now limited to mdatp and Edge.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

images/shared/files/10-workstation-sshd.conf

@@ -1,6 +0,0 @@
-# Key-only SSH for local accounts (add keys to ~/.ssh/authorized_keys).
-PubkeyAuthentication yes
-PermitRootLogin no
-PasswordAuthentication no
-PermitEmptyPasswords no
-KbdInteractiveAuthentication no

images/shared/files/50-defender.preset

@@ -1,4 +0,0 @@
-# Defender: first-boot setup, the daemon and its network filter.
-enable mdatp-firstboot.service
-enable mdatp.service
-enable mde_netfilter_v2.socket

images/shared/files/50-workstation.preset

@@ -1,3 +0,0 @@
-enable gdm.service
-enable qemu-guest-agent.service
-enable sshd.service

images/shared/files/mdatp-firstboot

@@ -1,17 +0,0 @@
-#!/usr/bin/env bash
-# Finish the Defender (mdatp) install on first boot by running the package's
-# own %post, saved at build time: it creates the machine GUID, state, logs and
-# definitions database under /var and then enables and starts mdatp.service.
-set -euo pipefail
-
-MARKER=/var/lib/mdatp-firstboot.done
-
-[[ -f "${MARKER}" ]] && exit 0
-
-# mdatp.service only starts once the marker exists (10-firstboot.conf), and the
-# %post starts it, so create the marker first and drop it again on failure.
-touch "${MARKER}"
-if ! bash /usr/libexec/mdatp-postinst 1; then
-  rm -f "${MARKER}"
-  exit 1
-fi

images/shared/files/mdatp-firstboot.conf

@@ -1,3 +0,0 @@
-# Don't start Defender before mdatp-firstboot.service has created its state.
-[Unit]
-ConditionPathExists=/var/lib/mdatp-firstboot.done

images/shared/files/mdatp-firstboot.service

@@ -1,15 +0,0 @@
-[Unit]
-Description=Finish the Microsoft Defender for Endpoint install on first boot
-Documentation=https://learn.microsoft.com/en-us/defender-endpoint/microsoft-defender-endpoint-linux
-After=network-online.target
-Wants=network-online.target
-ConditionPathExists=!/var/lib/mdatp-firstboot.done
-
-[Service]
-Type=oneshot
-ExecStart=/usr/libexec/mdatp-firstboot
-RemainAfterExit=yes
-TimeoutStartSec=15min
-
-[Install]
-WantedBy=multi-user.target