2.3.5

What's Changed

• Backport/batch to 2.x 20260210152956 by @dmulder in #1106

Fixes

• Resolve Intune enrollment failure that blocked first login authentication.
• Handle AADSTS50125/password reset required via device flow; avoid DAG loop when SSPR is demanded.
• Improve PAM error messaging and SSPR guidance; better PAM deny messaging.
• PAM chauthtok: return PAM_IGNORE for local users.
• Correct asset paths.

Platform/Integration

• Add fusermount3 to AppArmor profile.

Intune/Service Updates

• Dynamically look up latest Intune API version to avoid rejection from outdated API versions.

Dependencies/Tooling

• Update libhimmelblau and various Rust dependencies; refresh cargo vet records.

Full Changelog: 2.3.4...2.3.5