feat: bump moves here, and verify-base takes images by name

- image_tools/bump.py from base-os, with an action. base-python used it from
  a pinned checkout of base-os, with the bot's token; one place serves both.
  A dependent whose workflow does not exist (netork's ui-nightly.yml, on
  2026-10-22) is named and the others go on; the run fails at the end, as
  for a repository the token cannot see. bump_all holds that loop, tested.
- verify-base takes refs besides Dockerfiles: base-python builds FROM
  ${BASE_OS}, which its nightly sets, and copies CPython from Docker's
  python:3.12-slim, which is not signed with netOrk's key.

actions/bump/action.yml

@@ -0,0 +1,35 @@
+name: Move the pin in every dependent
+description: >-
+  Open or update one pull request in every repository of dependents.toml that
+  moves only the pin, and start that repository's workflow (image_tools/bump.py).
+  The caller passes BUMP_TOKEN, the netork-bot account's token, as env.
+inputs:
+  image:
+    description: The image whose pin moves, e.g. netork/base-os
+    required: true
+  ref:
+    description: The new reference, <image>:<version>@<digest>
+    required: true
+  version:
+    description: The new version
+    required: true
+  report:
+    description: The pull requests' body, a file
+    default: report.md
+  dependents:
+    description: The repositories that pin the image
+    default: dependents.toml
+runs:
+  using: composite
+  steps:
+    - shell: bash
+      env:
+        IMAGE: ${{ inputs.image }}
+        REF: ${{ inputs.ref }}
+        VERSION: ${{ inputs.version }}
+        REPORT: ${{ inputs.report }}
+        DEPENDENTS: ${{ inputs.dependents }}
+        PYTHONPATH: ${{ github.action_path }}/../..
+      run: |
+        python3 -m image_tools.bump "$IMAGE" "$REF" "$VERSION" \
+          --report "$REPORT" --dependents "$DEPENDENTS"

actions/verify-base/action.yml

@@ -1,11 +1,17 @@
 name: Verify the base images
 description: >-
-  Every image the Dockerfiles build on is signed with netOrk's key, checked
-  before the build (NetOrk/netork#1390, bin/verify-base.sh).
+  Every image the Dockerfiles build on, and every image named in refs, is
+  signed with netOrk's key, checked before the build (NetOrk/netork#1390,
+  bin/verify-base.sh, bin/verify-signature.sh). Give one or both.
 inputs:
   dockerfiles:
-    description: The Dockerfiles, separated by spaces, relative to the workspace
-    required: true
+    description: Dockerfiles whose FROM images to verify, separated by spaces
+    default: ""
+  refs:
+    description: >-
+      Images to verify, <image>@<digest>, separated by spaces: for a FROM the
+      Dockerfile only knows as an argument
+    default: ""
 runs:
   using: composite
   steps:
@@ -16,5 +22,18 @@ runs:
       shell: bash
       env:
         DOCKERFILES: ${{ inputs.dockerfiles }}
-      # shellcheck disable=SC2086 # the list splits on purpose
-      run: bash "${{ github.action_path }}/../../bin/verify-base.sh" $DOCKERFILES
+        REFS: ${{ inputs.refs }}
+      # The lists split on spaces on purpose.
+      run: |
+        if [ -z "$DOCKERFILES$REFS" ]; then
+          echo "verify-base: give dockerfiles, refs or both" >&2
+          exit 1
+        fi
+        if [ -n "$DOCKERFILES" ]; then
+          # shellcheck disable=SC2086
+          bash "${{ github.action_path }}/../../bin/verify-base.sh" $DOCKERFILES
+        fi
+        if [ -n "$REFS" ]; then
+          # shellcheck disable=SC2086
+          bash "${{ github.action_path }}/../../bin/verify-signature.sh" $REFS
+        fi