feat: the verdict on a rebuild as an action too

base-os's nightly asks netOrk's matcher whether a rebuild improves on the
pin (image_tools/verify.py). As an action, a workflow needs nothing of this
repository but the pinned commit: no install, no checkout. A verdict that
could not be reached fails the step, as it does in base-os since the two
nights with an empty NETORK_LICENSE_KEY.

tests/test_actions.py

@@ -17,8 +17,8 @@ ROOT = Path(__file__).resolve().parents[1]
 ACTIONS = sorted((ROOT / "actions").glob("*/action.yml"))
 
 
-def test_the_three_actions():
-    assert [a.parent.name for a in ACTIONS] == ["judge", "sign", "verify-base"]
+def test_the_four_actions():
+    assert [a.parent.name for a in ACTIONS] == ["judge", "sign", "verdict", "verify-base"]
 
 
 @pytest.mark.parametrize("action", ACTIONS, ids=lambda a: a.parent.name)
@@ -36,3 +36,13 @@ def test_signing_needs_its_secrets_from_the_caller():
     text = (ROOT / "actions/sign/action.yml").read_text()
 
     assert "COSIGN_PRIVATE_KEY_B64" in text and "secrets." not in text
+
+
+def test_a_verdict_that_could_not_be_reached_fails_the_step():
+    """A silent "same" hid an empty NETORK_LICENSE_KEY for two nights (2026-10-21/22)."""
+    spec = yaml.safe_load((ROOT / "actions/verdict/action.yml").read_text())
+    [step] = spec["runs"]["steps"]
+
+    assert spec["outputs"]["improved"]["value"] == "${{ steps.verdict.outputs.improved }}"
+    assert "['error']" in step["run"] and "sys.exit(" in step["run"]
+    assert "cat report.md" in step["run"].splitlines()