ci: handle Debian Bullseye end of life

[rwgk]

Description

Debian Bullseye LTS ended on August 31, 2026. The Bullseye-backed container jobs have consequently started failing during package-index refreshes and installs, independently of pybind11 changes.

This preserves the existing test intent while making the package sources reliable:

• 293de1e keeps the Clang 5/C++14 and Clang 11 jobs because no Bookworm images exist for them. It pins both legacy container manifests and makes every Debian package source use one timestamped snapshot from Bullseye's final support day. Removing the image's extra source fragments also prevents mixing the snapshot with the live LLVM repository.
• 8fb1b4d moves the GCC 9, GCC 10, and Clang 16 jobs to their Bookworm images. GCC 10 changes from 10.5 to 10.4 because no GCC 10.5 Bookworm image exists; the GCC 10 compatibility lane remains intact.
• 3286eec moves the 32-bit classic-install job to i386 Bookworm, updates its Python label to 3.11, and uses Bookworm's matching pytest package.

The repository-wide pre-commit suite passes. The container/package combinations will be exercised by this PR's CI.

[rwgk]

Merging without review: this PR only changes .github/workflows/ci.yml

There is no production code change.

This will make our CI green again.