fedora-intune: query Defender through systemd-run instead of a snapshot

The health snapshot's temp directory, chmod and mv in /run every 5
minutes showed up in Defender's timeline as "Data Staged" and
"Executable permissions were added". Drop the snapshot service and
timer. The compliance script now runs `mdatp health` through
systemd-run, so systemd starts mdatp and Defender answers it even when
the script runs inside himmelblaud-tasks. Without systemd-run access it
asks mdatp directly, as before. No image support needed, so the script
works on other distros as is.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

images/fedora-intune/files/50-defender.preset

@@ -2,5 +2,3 @@
 enable mdatp-firstboot.service
 enable mdatp.service
 enable mde_netfilter_v2.socket
-# Health snapshot for the Intune compliance script.
-enable mdatp-health-snapshot.timer

images/fedora-intune/files/mdatp-health-snapshot

@@ -1,47 +0,0 @@
-#!/usr/bin/env bash
-# Save `mdatp health` fields to /run/mdatp-health/<field> for the Intune
-# custom compliance script (intune/defender-compliance.sh).
-#
-# That script runs inside himmelblaud-tasks.service, and Defender refuses to
-# answer it there: the daemon checks the calling process tree, can't read
-# /proc/<himmelblaud_tasks pid>/cmdline ("Permission denied" in
-# microsoft_defender_err.log), and the script sees no daemon. This runs from a
-# timer outside that service instead. Each file holds the raw
-# `mdatp health --field` output; the directory is replaced as a whole.
-set -euo pipefail
-
-MDATP=/usr/bin/mdatp
-DEST=/run/mdatp-health
-FIELDS=(
-  healthy
-  licensed
-  org_id
-  real_time_protection_enabled
-  behavior_monitoring
-  cloud_enabled
-  definitions_status
-  definitions_updated_minutes_ago
-  app_version
-)
-
-# Right after boot the daemon may not answer yet; give it up to 2 minutes so
-# the first snapshot isn't a false "not running".
-for _ in $(seq 1 24); do
-  [[ "$("${MDATP}" health --field healthy 2>/dev/null | tail -n1)" =~ ^(true|false)$ ]] && break
-  sleep 5
-done
-
-tmp="$(mktemp -d "${DEST}.XXXXXX")"
-trap 'rm -rf "${tmp}"' EXIT
-for field in "${FIELDS[@]}"; do
-  "${MDATP}" health --field "${field}" > "${tmp}/${field}" 2>/dev/null || true
-done
-chmod 0755 "${tmp}"
-chmod 0644 "${tmp}"/*
-
-# Swap in the new snapshot; readers see either the old or the new one.
-rm -rf "${DEST}.old"
-[[ -d "${DEST}" ]] && mv "${DEST}" "${DEST}.old"
-mv "${tmp}" "${DEST}"
-rm -rf "${DEST}.old"
-trap - EXIT

images/fedora-intune/files/mdatp-health-snapshot.service

@@ -1,7 +0,0 @@
-[Unit]
-Description=Save Microsoft Defender health for the Intune compliance check
-After=mdatp.service
-
-[Service]
-Type=oneshot
-ExecStart=/usr/libexec/mdatp-health-snapshot

images/fedora-intune/files/mdatp-health-snapshot.timer

@@ -1,11 +0,0 @@
-[Unit]
-Description=Save Microsoft Defender health every 5 minutes
-
-[Timer]
-# Early, so the compliance check at the first sign-in after boot finds a
-# snapshot; Himmelblau doesn't check again for 8 hours.
-OnBootSec=20s
-OnUnitActiveSec=5min
-
-[Install]
-WantedBy=timers.target