[kayx23]

Why this PR is needed

This maintenance branch has three independent sources of CI drift:

1. GitHub is moving ubuntu-latest from Ubuntu 24.04 to Ubuntu 26.04. The branch was validated against the former environment, so its active workflows are pinned to ubuntu-24.04 instead of backporting current runtime and product changes.
2. The CI bootstrap installs the latest pnpm dynamically. pnpm 12 now rejects pnpm setup when the installer is invoked through sudo, causing the build, Kubernetes, and Tars jobs to stop during setup. This PR applies the same narrow fix already used by APISIX 3.19 in fix(ci): unbreak CI under pnpm 12 #13921: activate the last known-good pnpm@11.25.0. It does not change Node.js or application dependencies.
3. Debian 11 Bullseye reached the end of LTS on August 31, 2026. Its packages moved away from the normal mirrors, so the development Docker build now receives 404 responses. The Dockerfile switches from debian:bullseye-slim to the official debian/eol:bullseye image, which uses Debian's archive repositories. This preserves Bullseye rather than upgrading a historical branch to Bookworm.

After those environment fixes, CI exposed two existing test-stability problems:

• The OpenID Connect logout tests contacted live Auth0 and Google discovery endpoints, and Auth0's current certificate chain could not be verified by this historical branch. This is not a runner failure or timing race, and rerunning cannot reliably fix a changed external certificate chain. This PR backports the test-only local-fixture fix from test(openid-connect): stop logout tests from calling live IdPs #13608 while preserving the logout assertions.
• The XRPC Prometheus test could scrape before its per-worker metrics had been flushed, and the Redis test could perform arithmetic on ngx.null before a counter existed. Both failed again during the automatic rerun, so this PR backports the established test-only fix from test(xrpc): fix first-run failures in redis.t and prometheus.t #13507. A rerun can hide these races but cannot remove them.

The same product behavior remains under test; product code is unchanged.

Changes

• pin every active GitHub Actions workflow to ubuntu-24.04
• pin the CI bootstrap to pnpm@11.25.0
• use the official Bullseye EOL image for both development Docker stages
• backport the self-hosted OpenID discovery test fixtures from test(openid-connect): stop logout tests from calling live IdPs #13608
• backport the XRPC first-run race fixes from test(xrpc): fix first-run failures in redis.t and prometheus.t #13507
• leave disabled workflows unchanged
• make no APISIX product, application dependency, or test-assertion changes

Validation

• the branch contains one commit
• all active workflow YAML files parse successfully
• bash -n ci/common.sh passes
• git diff --check passes
• the test-stability changes match the established fixes from test(openid-connect): stop logout tests from calling live IdPs #13608 and test(xrpc): fix first-run failures in redis.t and prometheus.t #13507
• full CI is rerunning