Behavior monitoring is off by default and the repair script never
checked it, so on devices without the image's managed config (another
distro, a plain install) it stayed off and the compliance rule failed.
Enable it, and cloud-delivered protection, when they're off and not
managed.
Only start mdatp-firstboot where the image installed it; elsewhere every
run logged that first-boot setup hadn't completed and tried to start a
unit that doesn't exist.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Wesley van TilburgandClaude Opus 5.5
3df9ce77d6