feat: bump moves here, and verify-base takes images by name

- image_tools/bump.py from base-os, with an action. base-python used it from
  a pinned checkout of base-os, with the bot's token; one place serves both.
  A dependent whose workflow does not exist (netork's ui-nightly.yml, on
  2026-10-22) is named and the others go on; the run fails at the end, as
  for a repository the token cannot see. bump_all holds that loop, tested.
- verify-base takes refs besides Dockerfiles: base-python builds FROM
  ${BASE_OS}, which its nightly sets, and copies CPython from Docker's
  python:3.12-slim, which is not signed with netOrk's key.

tests/test_actions.py

@@ -17,8 +17,10 @@ ROOT = Path(__file__).resolve().parents[1]
 ACTIONS = sorted((ROOT / "actions").glob("*/action.yml"))
 
 
-def test_the_four_actions():
-    assert [a.parent.name for a in ACTIONS] == ["judge", "sign", "verdict", "verify-base"]
+def test_the_actions():
+    names = [a.parent.name for a in ACTIONS]
+
+    assert names == ["bump", "judge", "sign", "verdict", "verify-base"]
 
 
 @pytest.mark.parametrize("action", ACTIONS, ids=lambda a: a.parent.name)
@@ -46,3 +48,21 @@ def test_a_verdict_that_could_not_be_reached_fails_the_step():
     assert spec["outputs"]["improved"]["value"] == "${{ steps.verdict.outputs.improved }}"
     assert "['error']" in step["run"] and "sys.exit(" in step["run"]
     assert "cat report.md" in step["run"].splitlines()
+
+
+def test_bumping_needs_its_token_from_the_caller():
+    text = (ROOT / "actions/bump/action.yml").read_text()
+
+    assert "BUMP_TOKEN" in text and "secrets." not in text
+
+
+def test_a_base_can_be_named_where_the_dockerfile_cannot():
+    """base-python builds FROM ${BASE_OS}, an argument the nightly sets, and copies
+    CPython from Docker's python:3.12-slim, which is not signed with netOrk's key.
+    It names the one image to verify instead."""
+    spec = yaml.safe_load((ROOT / "actions/verify-base/action.yml").read_text())
+    runs = "\n".join(step["run"] for step in spec["runs"]["steps"])
+
+    assert not spec["inputs"]["dockerfiles"].get("required")
+    assert "refs" in spec["inputs"]
+    assert "bin/verify-signature.sh" in runs and "bin/verify-base.sh" in runs