feat: judge, sign and verify netOrk's images in one place (NetOrk/netork#1390)

The CIS gate, the SBOM, the cosign signature and the matcher's verdict lived
in NetOrk/base-os, the head of the chain. Every link below it -- base-python,
engine, ui, satellite, the service images -- needs the same, so the tools
move here, and every image repository pins them by commit.

- image_tools: cis.py, cis_os.sh, sbom.py and verify.py from base-os. The
  image's own repository holds its cis.toml and packages.allow; both default
  to the working directory.
- bin/sign.sh signs whatever platforms a reference holds: base-os's index of
  amd64 and arm64 (EXPECT_PLATFORMS) or a dev image's single manifest
  (image_tools/platforms.py).
- bin/verify-base.sh checks every FROM image of a Dockerfile against
  cosign.pub before a build; one without a digest is refused
  (image_tools/dockerfile.py).
- bin/install-cosign.sh installs cosign v3.1.3 for amd64 and arm64 runners,
  checked against the release checksums.
- actions/verify-base, judge, sign wrap them for the workflows.
- cosign.pub is the public half of the COSIGN_PRIVATE_KEY_B64 org secret,
  the key rotated on 2026-10-22.

image_tools/sbom.py

@@ -0,0 +1,60 @@
+"""The CycloneDX SBOM of an image, as Trivy reads it.
+
+bin/sign.sh attaches it to each published platform image as an attestation,
+next to the CIS result, so what base-os holds can be read from the registry.
+
+    python -m image_tools.sbom <ref> <out.cdx.json>
+
+Standard library only; Trivy runs as the container image_tools/verify.py pins.
+"""
+
+from __future__ import annotations
+
+import argparse
+import json
+import subprocess
+from pathlib import Path
+
+from image_tools.verify import TIMEOUT, TRIVY_IMAGE
+
+
+def cyclonedx(ref: str) -> dict:  # pragma: no cover - container seam
+    proc = subprocess.run(
+        [
+            "docker",
+            "run",
+            "--rm",
+            "-v",
+            "/var/run/docker.sock:/var/run/docker.sock",
+            "-e",
+            "TRIVY_USERNAME",
+            "-e",
+            "TRIVY_PASSWORD",
+            TRIVY_IMAGE,
+            "image",
+            "--quiet",
+            "--disable-telemetry",
+            "--skip-version-check",
+            "--format",
+            "cyclonedx",
+            ref,
+        ],
+        capture_output=True,
+        text=True,
+        timeout=TIMEOUT,
+        check=True,
+    )
+    return json.loads(proc.stdout)
+
+
+def main() -> int:  # pragma: no cover - CLI seam
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("ref")
+    parser.add_argument("out")
+    args = parser.parse_args()
+    Path(args.out).write_text(json.dumps(cyclonedx(args.ref), indent=2))
+    return 0
+
+
+if __name__ == "__main__":  # pragma: no cover
+    raise SystemExit(main())