feat: bump moves here, and verify-base takes images by name

- image_tools/bump.py from base-os, with an action. base-python used it from
  a pinned checkout of base-os, with the bot's token; one place serves both.
  A dependent whose workflow does not exist (netork's ui-nightly.yml, on
  2026-10-22) is named and the others go on; the run fails at the end, as
  for a repository the token cannot see. bump_all holds that loop, tested.
- verify-base takes refs besides Dockerfiles: base-python builds FROM
  ${BASE_OS}, which its nightly sets, and copies CPython from Docker's
  python:3.12-slim, which is not signed with netOrk's key.

actions/bump/action.yml

@@ -0,0 +1,35 @@
+name: Move the pin in every dependent
+description: >-
+  Open or update one pull request in every repository of dependents.toml that
+  moves only the pin, and start that repository's workflow (image_tools/bump.py).
+  The caller passes BUMP_TOKEN, the netork-bot account's token, as env.
+inputs:
+  image:
+    description: The image whose pin moves, e.g. netork/base-os
+    required: true
+  ref:
+    description: The new reference, <image>:<version>@<digest>
+    required: true
+  version:
+    description: The new version
+    required: true
+  report:
+    description: The pull requests' body, a file
+    default: report.md
+  dependents:
+    description: The repositories that pin the image
+    default: dependents.toml
+runs:
+  using: composite
+  steps:
+    - shell: bash
+      env:
+        IMAGE: ${{ inputs.image }}
+        REF: ${{ inputs.ref }}
+        VERSION: ${{ inputs.version }}
+        REPORT: ${{ inputs.report }}
+        DEPENDENTS: ${{ inputs.dependents }}
+        PYTHONPATH: ${{ github.action_path }}/../..
+      run: |
+        python3 -m image_tools.bump "$IMAGE" "$REF" "$VERSION" \
+          --report "$REPORT" --dependents "$DEPENDENTS"