fedora-intune: query Defender through systemd-run instead of a snapshot

The health snapshot's temp directory, chmod and mv in /run every 5
minutes showed up in Defender's timeline as "Data Staged" and
"Executable permissions were added". Drop the snapshot service and
timer. The compliance script now runs `mdatp health` through
systemd-run, so systemd starts mdatp and Defender answers it even when
the script runs inside himmelblaud-tasks. Without systemd-run access it
asks mdatp directly, as before. No image support needed, so the script
works on other distros as is.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

images/fedora-intune/intune/defender-compliance.sh

@@ -2,30 +2,26 @@
 # Intune custom compliance discovery script for Linux: is Microsoft Defender
 # for Endpoint (mdatp) installed, onboarded, licensed and protecting?
 #
-# Upload in Intune > Devices > Compliance > Scripts (Linux), and pair it with
-# defender-compliance.json in a Linux compliance policy (Custom compliance).
-# Himmelblau runs it as root inside himmelblaud-tasks.service and sends the
-# JSON on stdout to Intune, which evaluates it against the rules. Every setting
-# is always emitted, so a missing or stopped Defender reads as non-compliant
-# instead of as a script error.
+# Upload in Intune > Endpoint security > Device compliance > Scripts (Linux),
+# and pair it with defender-compliance.json in a Linux compliance policy
+# (Custom compliance). Himmelblau runs it as root inside
+# himmelblaud-tasks.service and sends the JSON on stdout to Intune, which
+# evaluates it against the rules. Every setting is always emitted, so a missing
+# or stopped Defender reads as non-compliant instead of as a script error.
 
 MDATP=/usr/bin/mdatp
-# Under Himmelblau, Defender won't answer `mdatp health` from this script, so
-# a root timer may save the fields in /run/mdatp-health (the fedora-intune
-# image does). Used when under 20 minutes old, otherwise mdatp is asked.
-SNAPSHOT=/run/mdatp-health
 
-if [[ -n "$(find "${SNAPSHOT}/healthy" -mmin -20 2>/dev/null)" ]]; then
-  raw_field() { cat "${SNAPSHOT}/$1" 2>/dev/null; }
-else
-  raw_field() { "${MDATP}" health --field "$1" 2>/dev/null; }
-fi
+# Defender won't answer `mdatp health` started from inside himmelblaud-tasks
+# (it can't read that process while checking the caller), so ask through
+# systemd, which runs mdatp as its own child. Elsewhere, ask mdatp directly.
+health="$(systemd-run --quiet --wait --pipe --collect "${MDATP}" health 2>/dev/null)"
+grep -q '^healthy' <<< "${health}" || health="$("${MDATP}" health 2>/dev/null)"
 
-# Print one `mdatp health` field without quotes or a trailing " [managed]".
-# Unlicensed or unonboarded, mdatp prints "ATTENTION: ..." lines first.
+# Print one field of the `mdatp health` output ("name : value") without
+# quotes or a trailing " [managed]".
 field() {
-  raw_field "$1" | grep -v '^ATTENTION' | tail -n1 \
-    | sed -e 's/ \[managed\]$//' -e 's/^"//' -e 's/"$//'
+  grep -m1 "^$1 *:" <<< "${health}" \
+    | sed -e 's/^[^:]*: *//' -e 's/ \[managed\]$//' -e 's/^"//' -e 's/"$//'
 }
 
 bool() {