upgrade or rebuild pauli / puppet

Puppet AKA pauli is going to be a particularly tricky bullseye upgrade, so it's not part of the large bullseye upgrade batches (#40690 (closed) or #40692 (closed)).

We need to decide how we handle the Puppet 5 EOL situation. We could use upstream packages, split up the service, there's many possibilities (#33588 (closed)). But this ticket is solely about upgrading the box, which could happen regardless, as bullseye was (bizarrely) with Puppet 5 (but not puppetdb!).

This also implies the decision on puppet-agent itself is done elsewhere (and that is probably #33588 (closed)).