[kayx23]

Why this PR is needed

This maintenance branch has three independent sources of CI drift:

1. GitHub is moving ubuntu-latest from Ubuntu 24.04 to Ubuntu 26.04. The branch was validated against the former environment, so its active workflows are pinned to ubuntu-24.04 instead of backporting current runtime and product changes.
2. The CI bootstrap installs the latest pnpm dynamically. pnpm 12 now rejects pnpm setup when the installer is invoked through sudo, causing the build, Kubernetes, and Tars jobs to stop during setup. This PR applies the same narrow fix already used by APISIX 3.19 in fix(ci): unbreak CI under pnpm 12 #13921: activate the last known-good pnpm@11.25.0. It does not change Node.js or application dependencies.
3. Debian 11 Bullseye reached the end of LTS on August 31, 2026. Its packages moved away from the normal mirrors, so the development Docker build now receives 404 responses. The Dockerfile switches from debian:bullseye-slim to the official debian/eol:bullseye image, which uses Debian's archive repositories. This preserves Bullseye rather than upgrading a historical branch to Bookworm.

After those environment fixes, CI exposed existing test-stability problems:

• The XRPC Prometheus test could scrape before its per-worker metrics had been flushed, and the Redis test could perform arithmetic on ngx.null before a counter existed. This PR backports the test-only fix from test(xrpc): fix first-run failures in redis.t and prometheus.t #13507.
• The stream Prometheus and DNS CLI tests used fixed sleeps while startup, route propagation, DNS preread handling, and exporter-cache population are asynchronous. This PR backports only the relevant readiness and bounded-probe changes from test(ci): fix flaky tests #13266.
• The etcd synchronization test used a fixed five-second sleep after toggling authentication, but watch reconnection and bulk event application can take longer. After this exact Round 2 Request 1 unexpected failure occurred, this PR backports the bounded readiness poll from test(ci): fix flaky tests #13332.
• The OpenID Connect logout tests contacted live Auth0 and Google discovery endpoints, and Auth0's current certificate chain could not be verified by this historical branch. This is not a runner race, and rerunning cannot repair an external certificate chain. This PR backports the local-fixture test fix from test(openid-connect): stop logout tests from calling live IdPs #13608 while preserving the logout assertions.

A rerun can sometimes hide timing races but cannot remove them. These already-reviewed test-only fixes make CI deterministic without changing product code or application dependencies.

Changes

• pin every active GitHub Actions workflow to ubuntu-24.04
• pin the CI bootstrap to pnpm@11.25.0
• use the official Bullseye EOL image for both development Docker stages
• backport the XRPC first-run race fixes from test(xrpc): fix first-run failures in redis.t and prometheus.t #13507
• backport the relevant stream Prometheus and DNS readiness fixes from test(ci): fix flaky tests #13266
• backport the demonstrated etcd resynchronization readiness fix from test(ci): fix flaky tests #13332
• backport the self-hosted OpenID discovery fixtures from test(openid-connect): stop logout tests from calling live IdPs #13608
• leave disabled workflows unchanged
• make no APISIX product or application dependency changes

Validation

• the branch contains one commit
• all active workflow YAML files parse successfully
• bash -n passes for the modified shell scripts
• git diff --check passes
• the test-stability changes match the established fixes from test(xrpc): fix first-run failures in redis.t and prometheus.t #13507, test(ci): fix flaky tests #13266, test(ci): fix flaky tests #13332, and test(openid-connect): stop logout tests from calling live IdPs #13608
• full CI is rerunning