ci: handle Debian Bullseye end of life

[rwgk]

Description

Debian Bullseye LTS ended on August 31, 2026. The Bullseye-backed container jobs have consequently started failing during package-index refreshes and installs, independently of pybind11 changes.

This preserves the existing test intent while making the package sources reliable:

• 293de1e keeps the Clang 5/C++14 and Clang 11 jobs because no Bookworm images exist for them. It pins both legacy container manifests and makes every Debian package source use one timestamped snapshot from Bullseye's final support day. Removing the image's extra source fragments also prevents mixing the snapshot with the live LLVM repository.
• 8fb1b4d moves the GCC 9, GCC 10, and Clang 16 jobs to their Bookworm images. GCC 10 changes from 10.5 to 10.4 because no GCC 10.5 Bookworm image exists; the GCC 10 compatibility lane remains intact.
• 3286eec moves the 32-bit classic-install job to i386 Bookworm, updates its Python label to 3.11, and uses Bookworm's matching pytest package.

The repository-wide pre-commit suite passes. The container/package combinations will be exercised by this PR's CI.

[rwgk]

Merging without review: this PR only changes .github/workflows/ci.yml

There is no production code change.

This will make our CI green again.

[rwgk]

I forgot to post this yesterday:

---

Follow-up: keep GCC 9 and GCC 10 on pinned Bullseye

cc8d189 adjusts the two legacy GCC jobs in response to the first PR CI run.

What the CI revealed

Both gcc:9-bookworm and gcc:10-bookworm failed before package installation or testing:

apt-get: /usr/local/lib64/libstdc++.so.6:
version `GLIBCXX_3.4.29' not found

The images put the selected compiler's libstdc++ in /usr/local/lib64. That is appropriate for testing GCC 9 or 10, but those older libraries cannot satisfy the ABI required by Bookworm's apt libraries. The GCC 10 failure is the same incompatibility, and even the same image digest, reported previously in docker-library/gcc#95 (on June 16, 2023).

It would be possible to make apt use Bookworm's system libstdc++ through a narrowly scoped loader-path override. That would leave us with an internally mixed environment, however, and another Bookworm C++ executable could fail for the same reason. Applying the override job-wide would be worse because the tests would then run against Bookworm's newer libstdc++, weakening the legacy-toolchain coverage.

What the commit changes

The commit therefore restores coherent Bullseye environments for these two lanes:

• GCC 9.5 uses a pinned gcc:9-bullseye image.
• GCC 10.5 uses a pinned gcc:10-bullseye image.
• Both jobs replace the retired live Bullseye repositories with the same timestamped Debian, updates, and security snapshot already used by the legacy Clang jobs.

Clang 16 and the 32-bit install job remain on Bookworm. Thus, jobs with compatible supported images still move forward, while the genuinely legacy compiler lanes use frozen, internally consistent environments.