fedora-intune: query Defender through systemd-run instead of a snapshot

The health snapshot's temp directory, chmod and mv in /run every 5
minutes showed up in Defender's timeline as "Data Staged" and
"Executable permissions were added". Drop the snapshot service and
timer. The compliance script now runs `mdatp health` through
systemd-run, so systemd starts mdatp and Defender answers it even when
the script runs inside himmelblaud-tasks. Without systemd-run access it
asks mdatp directly, as before. No image support needed, so the script
works on other distros as is.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

images/fedora-intune/defender.yaml

@@ -26,11 +26,6 @@ add-files:
   - ["mdatp-firstboot.service", "/usr/lib/systemd/system/mdatp-firstboot.service"]
   - ["mdatp-firstboot.conf", "/usr/lib/systemd/system/mdatp.service.d/10-firstboot.conf"]
   - ["50-defender.preset", "/usr/lib/systemd/system-preset/50-defender.preset"]
-  # Defender health for the Intune compliance script, which can't query
-  # Defender itself from inside himmelblaud-tasks; see the script.
-  - ["mdatp-health-snapshot", "/usr/libexec/mdatp-health-snapshot"]
-  - ["mdatp-health-snapshot.service", "/usr/lib/systemd/system/mdatp-health-snapshot.service"]
-  - ["mdatp-health-snapshot.timer", "/usr/lib/systemd/system/mdatp-health-snapshot.timer"]
   # Enforced Defender settings (shown as "[managed]" in `mdatp health`; local
   # changes are refused): real-time protection, behavior monitoring, PUA
   # blocking, cloud protection at the "high" block level, automatic updates
@@ -62,4 +57,4 @@ postprocess:
     # Fail the build on a typo rather than ship a config Defender can't read.
     python3 -m json.tool /usr/share/mdatp-managed/mdatp_managed.json > /dev/null
     rpm -q --qf '%{POSTIN}' mdatp > /usr/libexec/mdatp-postinst
-    chmod 0755 /usr/libexec/mdatp-firstboot /usr/libexec/mdatp-postinst /usr/libexec/mdatp-health-snapshot
+    chmod 0755 /usr/libexec/mdatp-firstboot /usr/libexec/mdatp-postinst