feat: bump moves here, and verify-base takes images by name

- image_tools/bump.py from base-os, with an action. base-python used it from
  a pinned checkout of base-os, with the bot's token; one place serves both.
  A dependent whose workflow does not exist (netork's ui-nightly.yml, on
  2026-10-22) is named and the others go on; the run fails at the end, as
  for a repository the token cannot see. bump_all holds that loop, tested.
- verify-base takes refs besides Dockerfiles: base-python builds FROM
  ${BASE_OS}, which its nightly sets, and copies CPython from Docker's
  python:3.12-slim, which is not signed with netOrk's key.

actions/verify-base/action.yml

@@ -1,11 +1,17 @@
 name: Verify the base images
 description: >-
-  Every image the Dockerfiles build on is signed with netOrk's key, checked
-  before the build (NetOrk/netork#1390, bin/verify-base.sh).
+  Every image the Dockerfiles build on, and every image named in refs, is
+  signed with netOrk's key, checked before the build (NetOrk/netork#1390,
+  bin/verify-base.sh, bin/verify-signature.sh). Give one or both.
 inputs:
   dockerfiles:
-    description: The Dockerfiles, separated by spaces, relative to the workspace
-    required: true
+    description: Dockerfiles whose FROM images to verify, separated by spaces
+    default: ""
+  refs:
+    description: >-
+      Images to verify, <image>@<digest>, separated by spaces: for a FROM the
+      Dockerfile only knows as an argument
+    default: ""
 runs:
   using: composite
   steps:
@@ -16,5 +22,18 @@ runs:
       shell: bash
       env:
         DOCKERFILES: ${{ inputs.dockerfiles }}
-      # shellcheck disable=SC2086 # the list splits on purpose
-      run: bash "${{ github.action_path }}/../../bin/verify-base.sh" $DOCKERFILES
+        REFS: ${{ inputs.refs }}
+      # The lists split on spaces on purpose.
+      run: |
+        if [ -z "$DOCKERFILES$REFS" ]; then
+          echo "verify-base: give dockerfiles, refs or both" >&2
+          exit 1
+        fi
+        if [ -n "$DOCKERFILES" ]; then
+          # shellcheck disable=SC2086
+          bash "${{ github.action_path }}/../../bin/verify-base.sh" $DOCKERFILES
+        fi
+        if [ -n "$REFS" ]; then
+          # shellcheck disable=SC2086
+          bash "${{ github.action_path }}/../../bin/verify-signature.sh" $REFS
+        fi