feat: judge, sign and verify netOrk's images in one place (NetOrk/netork#1390)

The CIS gate, the SBOM, the cosign signature and the matcher's verdict lived
in NetOrk/base-os, the head of the chain. Every link below it -- base-python,
engine, ui, satellite, the service images -- needs the same, so the tools
move here, and every image repository pins them by commit.

- image_tools: cis.py, cis_os.sh, sbom.py and verify.py from base-os. The
  image's own repository holds its cis.toml and packages.allow; both default
  to the working directory.
- bin/sign.sh signs whatever platforms a reference holds: base-os's index of
  amd64 and arm64 (EXPECT_PLATFORMS) or a dev image's single manifest
  (image_tools/platforms.py).
- bin/verify-base.sh checks every FROM image of a Dockerfile against
  cosign.pub before a build; one without a digest is refused
  (image_tools/dockerfile.py).
- bin/install-cosign.sh installs cosign v3.1.3 for amd64 and arm64 runners,
  checked against the release checksums.
- actions/verify-base, judge, sign wrap them for the workflows.
- cosign.pub is the public half of the COSIGN_PRIVATE_KEY_B64 org secret,
  the key rotated on 2026-10-22.

image_tools/platforms.py

@@ -0,0 +1,64 @@
+"""The platform images of a published reference, for bin/sign.sh.
+
+An index (base-os, a released netork image) lists them; a single manifest (a
+netork dev image) is one itself, its architecture in its config. Each line out
+is ``<arch> <digest>``. Only amd64 and arm64 are built, so anything else, or
+nothing at all, is an error rather than a quiet skip.
+
+    python -m image_tools.platforms <digest> <raw.json> <image.json>
+
+``raw.json`` is ``docker buildx imagetools inspect --raw``, ``image.json`` its
+``--format '{{json .Image}}'``, and ``<digest>`` the reference's own.
+"""
+
+from __future__ import annotations
+
+import argparse
+import json
+from pathlib import Path
+
+BUILT = ("amd64", "arm64")
+INDEXES = (
+    "application/vnd.oci.image.index.v1+json",
+    "application/vnd.docker.distribution.manifest.list.v2+json",
+)
+
+
+def _checked(arch: str) -> str:
+    if arch not in BUILT:
+        raise ValueError(f"{arch} is not a platform built here ({', '.join(BUILT)})")
+    return arch
+
+
+def platforms(raw: str, image: str, digest: str) -> list[tuple[str, str]]:
+    """``(arch, digest)`` of every platform image behind the reference."""
+    manifest = json.loads(raw)
+    if manifest.get("mediaType") in INDEXES or "manifests" in manifest:
+        found = []
+        for entry in manifest.get("manifests") or []:
+            platform = entry.get("platform") or {}
+            if platform.get("os") != "linux":
+                continue  # buildx's attestation manifests say "unknown"
+            found.append((_checked(platform.get("architecture", "")), entry["digest"]))
+    else:
+        arch = (json.loads(image) or {}).get("architecture")
+        found = [(_checked(arch), digest)] if arch else []
+    if not found:
+        raise ValueError("the reference holds no platform image to sign")
+    return found
+
+
+def main() -> int:  # pragma: no cover - CLI seam
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("digest")
+    parser.add_argument("raw")
+    parser.add_argument("image")
+    args = parser.parse_args()
+    found = platforms(Path(args.raw).read_text(), Path(args.image).read_text(), args.digest)
+    for arch, digest in found:
+        print(arch, digest)
+    return 0
+
+
+if __name__ == "__main__":  # pragma: no cover
+    raise SystemExit(main())