Moving bump.py from base-os took its tests up to the one that checks
base-os's own dependents.toml and cut everything after it: an odd new
reference, a repo without the file yet, a dependent without a workflow, a
compose pin with the registry variable, a repo the bot may not see. They
are back; base-os's list check stays in base-os.
- image_tools/bump.py from base-os, with an action. base-python used it from
a pinned checkout of base-os, with the bot's token; one place serves both.
A dependent whose workflow does not exist (netork's ui-nightly.yml, on
2026-10-22) is named and the others go on; the run fails at the end, as
for a repository the token cannot see. bump_all holds that loop, tested.
- verify-base takes refs besides Dockerfiles: base-python builds FROM
${BASE_OS}, which its nightly sets, and copies CPython from Docker's
python:3.12-slim, which is not signed with netOrk's key.