[kayx23]

Why this PR is needed

This maintenance branch has three independent sources of CI drift:

1. GitHub is moving ubuntu-latest from Ubuntu 24.04 to Ubuntu 26.04. The branch was validated against the former environment, so its active workflows are pinned to ubuntu-24.04 instead of backporting current runtime and product changes.
2. The CI bootstrap installs the latest pnpm dynamically. pnpm 12 now rejects pnpm setup when the installer is invoked through sudo, causing the build, Kubernetes, and Tars jobs to stop during setup. This PR applies the same narrow fix already used by APISIX 3.19 in fix(ci): unbreak CI under pnpm 12 #13921: activate the last known-good pnpm@11.25.0. It does not change Node.js or application dependencies.
3. Debian 11 Bullseye reached the end of LTS on August 31, 2026. Its packages moved away from the normal mirrors, so the development Docker build now receives 404 responses. The Dockerfile switches from debian:bullseye-slim to the official debian/eol:bullseye image, which uses Debian's archive repositories. This preserves Bullseye rather than upgrading a historical branch to Bookworm.

Changes

• pin every active GitHub Actions workflow to ubuntu-24.04
• pin the CI bootstrap to pnpm@11.25.0
• use the official Bullseye EOL image for both development Docker stages
• leave disabled workflows unchanged
• make no APISIX product, dependency, or test-assertion changes

Validation

• the branch contains one commit
• all active workflow YAML files parse successfully
• bash -n ci/common.sh passes
• git diff --check passes
• the published diff is limited to active workflows, ci/common.sh, and docker/debian-dev/Dockerfile
• full CI is rerunning