feat(check): an offline input runs the mirror's offline verb

.github/workflows/check.yml

@@ -1,7 +1,13 @@
 # Reusable: render the mirror's pipeline inside its image and diff it against render.txt.
+# With offline: true, the job then runs the mirror's offline verb in the image.
 name: check
 on:
-  workflow_call: {}
+  workflow_call:
+    inputs:
+      offline:
+        description: The job runs task offline in the image after task check
+        type: boolean
+        default: false
 permissions:
   contents: read
 jobs:
@@ -17,3 +23,5 @@ jobs:
       - uses: ./.lib/.github/actions/toolbox
         with: {op: 'false'}   # a dry run needs no secrets
       - run: task check
+      - if: inputs.offline
+        run: task run -- task offline

README.md

@@ -756,8 +756,8 @@ flowchart TB
 
 On every pull request: checkout, lib at the same commit, the toolbox action without
 `op`, `task check`. No secret reaches it, so a pull request from a fork runs it safely. A
-mirror with more to check (an `offline` verb, a test suite) writes its own `check.yml`
-with the toolbox action and its own steps, as github and dropbox do.
+mirror with an `offline` verb sets `offline: true`. The job then runs
+`task run -- task offline` in the image.
 
 ### The toolbox action