feat: the verdict on a rebuild as an action too

base-os's nightly asks netOrk's matcher whether a rebuild improves on the
pin (image_tools/verify.py). As an action, a workflow needs nothing of this
repository but the pinned commit: no install, no checkout. A verdict that
could not be reached fails the step, as it does in base-os since the two
nights with an empty NETORK_LICENSE_KEY.

actions/verdict/action.yml

@@ -0,0 +1,39 @@
+name: Judge a rebuild against the pin
+description: >-
+  Whether a candidate improves on the pinned image, by netOrk's matcher in
+  kb-server (image_tools/verify.py). Writes verdict.json and report.md, prints
+  the report, and fails when no verdict could be reached. The caller passes
+  NETORK_LICENSE_KEY, and TRIVY_USERNAME/TRIVY_PASSWORD for the registry, as env.
+inputs:
+  current:
+    description: The pinned image
+    required: true
+  candidate:
+    description: The rebuild
+    required: true
+  packages:
+    description: The packages the image may hold, for the CIS part of the verdict
+    default: packages.allow
+outputs:
+  improved:
+    description: '"true" when the candidate improves on the pin'
+    value: ${{ steps.verdict.outputs.improved }}
+runs:
+  using: composite
+  steps:
+    - id: verdict
+      shell: bash
+      env:
+        CURRENT: ${{ inputs.current }}
+        CANDIDATE: ${{ inputs.candidate }}
+        PACKAGES: ${{ inputs.packages }}
+        PYTHONPATH: ${{ github.action_path }}/../..
+      run: |
+        python3 -m image_tools.verify "$CURRENT" "$CANDIDATE" --packages "$PACKAGES" \
+          --json verdict.json --report report.md
+        # Into the log: Gitea shows no step summary.
+        cat report.md
+        cat report.md >> "$GITHUB_STEP_SUMMARY"
+        python3 -c "import json; print('improved=' + str(json.load(open('verdict.json'))['improved']).lower())" >> "$GITHUB_OUTPUT"
+        # A verdict that could not be reached is no "same": the step fails, so it is seen.
+        python3 -c "import json, sys; e = json.load(open('verdict.json'))['error']; sys.exit(f'no verdict: {e}' if e else 0)"