fedora-intune: minimal GNOME workstation with Intune and Defender

New image for testing Microsoft Intune enrollment and Linux compliance
policies: a minimal GNOME workstation (gnome-initial-setup, Ptyxis,
Files) with the Intune app, the Microsoft identity broker, Edge and
Defender for Endpoint (mdatp) from packages.microsoft.com (RHEL 10
builds, limited to those packages with includepkgs).

No Kanidm: the Intune app installs its own authselect profile with
pam_intune for the password compliance checks. Its %post cannot select
the profile or load the SELinux module during a compose, so both are
redone in postprocess.

build.sh now copies every *.yaml of an image, so manifests can be split
into more files than manifest.yaml and custom.yaml.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

ci-changes.sh

@@ -1,6 +1,6 @@
 #!/usr/bin/env bash
-# Given changed paths on stdin, print `cosmic=<bool>` and `remote=<bool>` so the
-# workflow can skip images that didn't change. Shared files or build tooling
+# Given changed paths on stdin, print `cosmic=<bool>`, `remote=<bool>` and
+# `intune=<bool>` so the workflow can skip images that didn't change. Shared files or build tooling
 # changes rebuild everything; empty input (schedule/manual) rebuilds everything.
 set -euo pipefail
 
@@ -13,12 +13,16 @@ grep -qE '^images/shared/' <<< "${changed}" && all=1
 
 cosmic=false
 remote=false
+intune=false
 if [[ "${all}" == 1 ]]; then
   cosmic=true
   remote=true
+  intune=true
 fi
 grep -qE '^images/fedora-cosmic/' <<< "${changed}" && cosmic=true
 grep -qE '^images/fedora-remote/' <<< "${changed}" && remote=true
+grep -qE '^images/fedora-intune/' <<< "${changed}" && intune=true
 
 echo "cosmic=${cosmic}"
 echo "remote=${remote}"
+echo "intune=${intune}"