feat: the verdict on a rebuild as an action too

base-os's nightly asks netOrk's matcher whether a rebuild improves on the
pin (image_tools/verify.py). As an action, a workflow needs nothing of this
repository but the pinned commit: no install, no checkout. A verdict that
could not be reached fails the step, as it does in base-os since the two
nights with an empty NETORK_LICENSE_KEY.

README.md

@@ -38,6 +38,16 @@ with its CIS result and SBOM attached (NetOrk/netork#1390).
     image: registry.netork.io/netork/engine:main-abc1234
     arch: amd64
 
+# a base's nightly, to decide whether its pin moves:
+- name: Judge it against the pin
+  id: verdict
+  uses: https://git.netork.io/NetOrk/image-tools/actions/verdict@<commit>
+  env:
+    NETORK_LICENSE_KEY: ${{ secrets.NETORK_LICENSE_KEY }}
+  with:
+    current: registry.netork.io/netork/base-os:pinned
+    candidate: registry.netork.io/netork/base-os:13-20261022.3-amd64
+
 # push it, then:
 - name: Sign it
   uses: https://git.netork.io/NetOrk/image-tools/actions/sign@<commit>