toolchain: Debian 13 / GCC 14 / crosstool-NG 1.28 / uClibc-ng 1.0.54

[bhouse-nexthop]

⚠️ Draft — stacked PR. Kept as a draft to signal it is stacked on #1125, #1126, #1127, #1128. It will be marked ready for review once #1125, #1126, #1127, #1128 merge into onie-modernization-2026 (and I rebase so this PR's diff narrows to only its own commits).

Targets onie-modernization-2026. This is the first half of the old toolchain milestone (#1119), now split into toolchain (this PR) and kernel 6.18 (stacked follow-up).

Depends on (merge first): #1125, #1126, #1127, #1128. Those are pulled in here as four deps: PR #NNNN commits at the base of the branch. Each dependency is one squashed commit so it's individually identifiable; once they merge into onie-modernization-2026 I'll rebase and those commits drop out.

Note: the secure-boot signing stack moved to #1128

Previously this PR also bumped shim 15 → 16.1, switched pesign, dropped gnu-efi, and added the grub SBAT bits. That was unnecessary coupling — none of it requires GCC 14 (shim 16.1 builds fine on the existing toolchain), so it now lives in the EFI/boot-stack PR (#1128) where it belongs. This PR is now purely the toolchain/host move.

What this does (own commit, on top of the 4 dep commits)

toolchain: move to Debian 13 / GCC 14 / crosstool-NG 1.28 / uClibc-ng 1.0.54

• Build host Debian 11 → 13 (the old crosstool-NG 1.24 / GCC 8.3 can't build on a Debian 13 host, so host + toolchain move together).
• crosstool-NG 1.24 → 1.28.0, GCC 8.3 → 14, uClibc-ng 1.0.38 → 1.0.54, binutils 2.45; XTOOLS_LINUX_VERSION decoupling so image-kernel bumps don't rebuild the toolchain.
• mokutil 0.4.0 → 0.7.2 (adds a libkeyutils dependency).
• grub i386-pc kernel.img link fix for binutils ≥ 2.39 (custom linker script + autogen.sh + autoconf-archive) — needs the new toolchain, so it lives here rather than with the grub package bump in packages: modernize the EFI/boot stack (grub 2.14, shim 16.1, efivar 39, efibootmgr 18) #1128.
• images.make GCC 14 libstdc++ SONAME; xorriso 1.5.6 (Debian 13) recovery-iso fix.
• Build pre-6.x kernels under GCC 14 (KERNEL_OLD_GCC_COMPAT): the existing 5.4 kernel is kept and built under the new toolchain via CONFIG_STACK_VALIDATION= + -Wno-error. This is what lets the toolchain move land independently of the kernel bump.

The kernel stays at 5.4.86 in this PR. The bump to 6.18 is the stacked kernel PR (#1130).

Note on validation

This builds a combination that hasn't been built before — GCC 14 with the kernel still at 5.4 (the milestone previously moved both together). -Wno-error makes it work; this PR's CI proves it end-to-end.