CI acceptance matrix fails for fork PRs with --nightly

Summary

Fork PR CI currently fails in the acceptance path because the unauthenticated dependency path selects an old Litmus version.

Example run: https://github.com/puppetlabs/puppetlabs-stdlib/actions/runs/29689427912/job/88199539690?pr=1479

What appears to be happening

.github/workflows/ci.yml passes flags: "--nightly" to the shared module_acceptance.yml workflow. That is still desirable for trusted CI because it requests nightly Puppetcore packages.

For fork PRs, secrets are not available, so PUPPET_FORGE_TOKEN is not set. The module Gemfile then selects puppet_litmus ~> 1.0:

gem "puppet_litmus", '~> 1.0', require: false if ENV['PUPPET_FORGE_TOKEN'].to_s.empty?

That old Litmus path does not have the newer public fallback behavior. It can reject --nightly during matrix setup, or generate nightly Puppet collections that are unavailable without credentials.

Suggested fix

Use puppet_litmus ~> 2.5 for system tests.

Litmus 2.5+ accepts --nightly and falls back to public Puppet collections when PUPPET_FORGE_TOKEN is unavailable. That keeps the workflow's nightly intent for trusted runs while allowing fork PRs to run without private package access.

Proposed PR: https://github.com/puppetlabs/puppetlabs-stdlib/pull/1481

Start with the puppet_litmus dependency selection in the module Gemfile and the flags passed from .github/workflows/ci.yml to module_acceptance.yml. Verify the acceptance matrix for a fork PR with --nightly, and consider the issue's proposed puppet_litmus version change done when that path completes without credentials.