fix: Correct M365 E3 licensing capabilities across playbooks

E3 includes Entra ID P1 (conditional access, SSPR) and Defender for
Endpoint P1 (AV, device control, ASR audit mode), not just 'Free'/'AV only'.

Key corrections:
- m365-e3-hardening.md: Entra ID P1 with conditional access is now
  correctly listed as included; Intune is full not 'basic'; ASR audit
  mode is available in P1; risk-based gap reframed as 'No Entra ID P2'
- zero-budget-hardening.md: E3 comparison table now shows Entra ID P1
  and Defender for Endpoint P1 correctly; pitch text updated
- modular-engagements.md: MFA description now reflects conditional
  access availability in E3
- m365-antifragile-project.md: Conditional Access heading now correctly
  notes E3 includes P1; E3 baseline mentions conditional access
- endpoint-management-entry-vector.md: Intune described as full MDM/MAM

antifragile-consulting/playbooks/endpoint-management-entry-vector.md

@@ -173,7 +173,7 @@ This builds **trust and political capital** for the harder conversations that fo
 - BYOD vs. corporate-owned: define the boundary clearly
 - Privacy regulations: employee monitoring on personal devices requires legal review
 - Network security: home Wi-Fi is untrusted; DNS security and VPN policies critical
-- Licensing: Intune is included in E3; no additional purchase required for basic MDM
+- Licensing: Intune is included in E3; no additional purchase required for MDM/MAM
 
 ### Archetype 3: The Compliance-Driven Client