Add IntelliJ IDEA CE and Ultimate as macOS FMAs (#36026)

Introduces maintained app definitions, install/uninstall scripts, and
icons for IntelliJ IDEA Community Edition and Ultimate. Updates the app
catalog and frontend assets to include both editions.

<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

- [ ] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

- [ ] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements)
- [ ] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes

## Testing

- [ ] Added/updated automated tests
- [ ] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)

- [ ] QA'd all new/changed functionality manually

For unreleased bug fixes in a release candidate, one of:

- [ ] Confirmed that the fix is not expected to adversely impact load
test results
- [ ] Alerted the release DRI if additional load testing is needed

## Database migrations

- [ ] Checked schema for all modified table for columns that will
auto-update timestamps during migration.
- [ ] Confirmed that updating the timestamps is acceptable, and will not
cause unwanted side effects.
- [ ] Ensured the correct collation is explicitly set for character
columns (`COLLATE utf8mb4_unicode_ci`).

## New Fleet configuration settings

- [ ] Setting(s) is/are explicitly excluded from GitOps

If you didn't check the box above, follow this checklist for
GitOps-enabled settings:

- [ ] Verified that the setting is exported via `fleetctl
generate-gitops`
- [ ] Verified the setting is documented in a separate PR to [the GitOps
documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485)
- [ ] Verified that the setting is cleared on the server if it is not
supplied in a YAML file (or that it is documented as being optional)
- [ ] Verified that any relevant UI is disabled when GitOps mode is
enabled

## fleetd/orbit/Fleet Desktop

- [ ] Verified compatibility with the latest released version of Fleet
(see [Must
rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md))
- [ ] If the change applies to only one platform, confirmed that
`runtime.GOOS` is used as needed to isolate changes
- [ ] Verified that fleetd runs on macOS, Linux and Windows
- [ ] Verified auto-update works from the released version of component
to the new version (see [tools/tuf/test](../tools/tuf/test/README.md))

ee/maintained-apps/inputs/homebrew/intellij-idea-ce.json

@@ -0,0 +1,8 @@
+{
+  "name": "IntelliJ IDEA CE",
+  "unique_identifier": "com.jetbrains.intellij.ce",
+  "token": "intellij-idea-ce",
+  "installer_format": "dmg",
+  "slug": "intellij-idea-ce/darwin",
+  "default_categories": ["Developer tools"]
+}

ee/maintained-apps/inputs/homebrew/intellij-idea.json

@@ -0,0 +1,8 @@
+{
+  "name": "IntelliJ IDEA Ultimate",
+  "unique_identifier": "com.jetbrains.intellij",
+  "token": "intellij-idea",
+  "installer_format": "dmg",
+  "slug": "intellij-idea/darwin",
+  "default_categories": ["Developer tools"]
+}

ee/maintained-apps/outputs/apps.json

@@ -260,6 +260,20 @@
       "unique_identifier": "com.DigiDNA.iMazingProfileEditorMac",
       "description": "iMazing Profile Editor is an app for creating and editing Apple configuration profiles."
     },
+    {
+      "name": "IntelliJ IDEA CE",
+      "slug": "intellij-idea-ce/darwin",
+      "platform": "darwin",
+      "unique_identifier": "com.jetbrains.intellij.ce",
+      "description": "IntelliJ IDEA CE is a community edition IDE for Java development by JetBrains."
+    },
+    {
+      "name": "IntelliJ IDEA Ultimate",
+      "slug": "intellij-idea/darwin",
+      "platform": "darwin",
+      "unique_identifier": "com.jetbrains.intellij",
+      "description": "IntelliJ IDEA Ultimate is a Java IDE by JetBrains."
+    },
     {
       "name": "Company Portal",
       "slug": "intune-company-portal/darwin",

ee/maintained-apps/outputs/intellij-idea-ce/darwin.json

@@ -0,0 +1,21 @@
+{
+  "versions": [
+    {
+      "version": "2025.2.4",
+      "queries": {
+        "exists": "SELECT 1 FROM apps WHERE bundle_identifier = 'com.jetbrains.intellij.ce';"
+      },
+      "installer_url": "https://download.jetbrains.com/idea/ideaIC-2025.2.4-aarch64.dmg",
+      "install_script_ref": "c9b80231",
+      "uninstall_script_ref": "e71c8e64",
+      "sha256": "c4e1ae63bf8683d12d307d6eca13f9ddb688df932608eb258a1c66ee5d45b6c3",
+      "default_categories": [
+        "Developer tools"
+      ]
+    }
+  ],
+  "refs": {
+    "c9b80231": "#!/bin/sh\n\n# variables\nAPPDIR=\"/Applications/\"\nTMPDIR=$(dirname \"$(realpath $INSTALLER_PATH)\")\n# functions\n\nquit_application() {\n  local bundle_id=\"$1\"\n  local timeout_duration=10\n\n  # check if the application is running\n  if ! osascript -e \"application id \\\"$bundle_id\\\" is running\" 2>/dev/null; then\n    return\n  fi\n\n  local console_user\n  console_user=$(stat -f \"%Su\" /dev/console)\n  if [[ $EUID -eq 0 && \"$console_user\" == \"root\" ]]; then\n    echo \"Not logged into a non-root GUI; skipping quitting application ID '$bundle_id'.\"\n    return\n  fi\n\n  echo \"Quitting application '$bundle_id'...\"\n\n  # try to quit the application within the timeout period\n  local quit_success=false\n  SECONDS=0\n  while (( SECONDS < timeout_duration )); do\n    if osascript -e \"tell application id \\\"$bundle_id\\\" to quit\" >/dev/null 2>&1; then\n      if ! pgrep -f \"$bundle_id\" >/dev/null 2>&1; then\n        echo \"Application '$bundle_id' quit successfully.\"\n        quit_success=true\n        break\n      fi\n    fi\n    sleep 1\n  done\n\n  if [[ \"$quit_success\" = false ]]; then\n    echo \"Application '$bundle_id' did not quit.\"\n  fi\n}\n\n\n# extract contents\nMOUNT_POINT=$(mktemp -d /tmp/dmg_mount_XXXXXX)\nhdiutil attach -plist -nobrowse -readonly -mountpoint \"$MOUNT_POINT\" \"$INSTALLER_PATH\"\nsudo cp -R \"$MOUNT_POINT\"/* \"$TMPDIR\"\nhdiutil detach \"$MOUNT_POINT\"\n# copy to the applications folder\nquit_application 'com.jetbrains.intellij.ce'\nif [ -d \"$APPDIR/IntelliJ IDEA CE.app\" ]; then\n\tsudo mv \"$APPDIR/IntelliJ IDEA CE.app\" \"$TMPDIR/IntelliJ IDEA CE.app.bkp\"\nfi\nsudo cp -R \"$TMPDIR/IntelliJ IDEA CE.app\" \"$APPDIR\"\n",
+    "e71c8e64": "#!/bin/sh\n\n# variables\nAPPDIR=\"/Applications/\"\nLOGGED_IN_USER=$(scutil <<< \"show State:/Users/ConsoleUser\" | awk '/Name :/ { print $3 }')\n# functions\n\ntrash() {\n  local logged_in_user=\"$1\"\n  local target_file=\"$2\"\n  local timestamp=\"$(date +%Y-%m-%d-%s)\"\n  local rand=\"$(jot -r 1 0 99999)\"\n\n  # replace ~ with /Users/$logged_in_user\n  if [[ \"$target_file\" == ~* ]]; then\n    target_file=\"/Users/$logged_in_user${target_file:1}\"\n  fi\n\n  local trash=\"/Users/$logged_in_user/.Trash\"\n  local file_name=\"$(basename \"${target_file}\")\"\n\n  if [[ -e \"$target_file\" ]]; then\n    echo \"removing $target_file.\"\n    mv -f \"$target_file\" \"$trash/${file_name}_${timestamp}_${rand}\"\n  else\n    echo \"$target_file doesn't exist.\"\n  fi\n}\n\nsudo rm -rf \"$APPDIR/IntelliJ IDEA CE.app\"\nsudo rm -rf 'idea-ce'\ntrash $LOGGED_IN_USER '~/Library/Application Support/JetBrains/IdeaIC2025.2'\ntrash $LOGGED_IN_USER '~/Library/Caches/JetBrains/IdeaIC2025.2'\ntrash $LOGGED_IN_USER '~/Library/Logs/JetBrains/IdeaIC2025.2'\ntrash $LOGGED_IN_USER '~/Library/Preferences/com.jetbrains.intellij.ce.plist'\ntrash $LOGGED_IN_USER '~/Library/Saved Application State/com.jetbrains.intellij.ce.savedState'\n"
+  }
+}

ee/maintained-apps/outputs/intellij-idea/darwin.json

@@ -0,0 +1,21 @@
+{
+  "versions": [
+    {
+      "version": "2025.2.4",
+      "queries": {
+        "exists": "SELECT 1 FROM apps WHERE bundle_identifier = 'com.jetbrains.intellij';"
+      },
+      "installer_url": "https://download.jetbrains.com/idea/ideaIU-2025.2.4-aarch64.dmg",
+      "install_script_ref": "f3bbbc1e",
+      "uninstall_script_ref": "582cd6de",
+      "sha256": "2b5504f86c6969ed0564483b6886390cfc1bb1b3ab99e658881d60edf57c481f",
+      "default_categories": [
+        "Developer tools"
+      ]
+    }
+  ],
+  "refs": {
+    "582cd6de": "#!/bin/sh\n\n# variables\nAPPDIR=\"/Applications/\"\nLOGGED_IN_USER=$(scutil <<< \"show State:/Users/ConsoleUser\" | awk '/Name :/ { print $3 }')\n# functions\n\ntrash() {\n  local logged_in_user=\"$1\"\n  local target_file=\"$2\"\n  local timestamp=\"$(date +%Y-%m-%d-%s)\"\n  local rand=\"$(jot -r 1 0 99999)\"\n\n  # replace ~ with /Users/$logged_in_user\n  if [[ \"$target_file\" == ~* ]]; then\n    target_file=\"/Users/$logged_in_user${target_file:1}\"\n  fi\n\n  local trash=\"/Users/$logged_in_user/.Trash\"\n  local file_name=\"$(basename \"${target_file}\")\"\n\n  if [[ -e \"$target_file\" ]]; then\n    echo \"removing $target_file.\"\n    mv -f \"$target_file\" \"$trash/${file_name}_${timestamp}_${rand}\"\n  else\n    echo \"$target_file doesn't exist.\"\n  fi\n}\n\nsudo rm -rf \"$APPDIR/IntelliJ IDEA.app\"\nsudo rm -rf 'idea'\ntrash $LOGGED_IN_USER '~/Library/Application Support/JetBrains/IntelliJIdea2025.2'\ntrash $LOGGED_IN_USER '~/Library/Caches/JetBrains/IntelliJIdea2025.2'\ntrash $LOGGED_IN_USER '~/Library/Logs/JetBrains/IntelliJIdea2025.2'\ntrash $LOGGED_IN_USER '~/Library/Preferences/com.jetbrains.intellij.plist'\ntrash $LOGGED_IN_USER '~/Library/Preferences/IntelliJIdea2025.2'\ntrash $LOGGED_IN_USER '~/Library/Preferences/jetbrains.idea.*.plist'\ntrash $LOGGED_IN_USER '~/Library/Saved Application State/com.jetbrains.intellij.savedState'\n",
+    "f3bbbc1e": "#!/bin/sh\n\n# variables\nAPPDIR=\"/Applications/\"\nTMPDIR=$(dirname \"$(realpath $INSTALLER_PATH)\")\n# functions\n\nquit_application() {\n  local bundle_id=\"$1\"\n  local timeout_duration=10\n\n  # check if the application is running\n  if ! osascript -e \"application id \\\"$bundle_id\\\" is running\" 2>/dev/null; then\n    return\n  fi\n\n  local console_user\n  console_user=$(stat -f \"%Su\" /dev/console)\n  if [[ $EUID -eq 0 && \"$console_user\" == \"root\" ]]; then\n    echo \"Not logged into a non-root GUI; skipping quitting application ID '$bundle_id'.\"\n    return\n  fi\n\n  echo \"Quitting application '$bundle_id'...\"\n\n  # try to quit the application within the timeout period\n  local quit_success=false\n  SECONDS=0\n  while (( SECONDS < timeout_duration )); do\n    if osascript -e \"tell application id \\\"$bundle_id\\\" to quit\" >/dev/null 2>&1; then\n      if ! pgrep -f \"$bundle_id\" >/dev/null 2>&1; then\n        echo \"Application '$bundle_id' quit successfully.\"\n        quit_success=true\n        break\n      fi\n    fi\n    sleep 1\n  done\n\n  if [[ \"$quit_success\" = false ]]; then\n    echo \"Application '$bundle_id' did not quit.\"\n  fi\n}\n\n\n# extract contents\nMOUNT_POINT=$(mktemp -d /tmp/dmg_mount_XXXXXX)\nhdiutil attach -plist -nobrowse -readonly -mountpoint \"$MOUNT_POINT\" \"$INSTALLER_PATH\"\nsudo cp -R \"$MOUNT_POINT\"/* \"$TMPDIR\"\nhdiutil detach \"$MOUNT_POINT\"\n# copy to the applications folder\nquit_application 'com.jetbrains.intellij'\nif [ -d \"$APPDIR/IntelliJ IDEA.app\" ]; then\n\tsudo mv \"$APPDIR/IntelliJ IDEA.app\" \"$TMPDIR/IntelliJ IDEA.app.bkp\"\nfi\nsudo cp -R \"$TMPDIR/IntelliJ IDEA.app\" \"$APPDIR\"\n"
+  }
+}