Hey, thanks for sharing such a detailed report and welcome to the Streamlit community! 
You’re absolutely right—this “Release file is expired” error for bullseye-security during the apt step is a known issue with the underlying Debian security mirror used by Streamlit Community Cloud. It’s not caused by your code, requirements.txt, or packages.txt, and rebooting or redeploying won’t resolve it on your end. This happens when the base image’s apt sources point to a security repo whose Release file has expired, and only the Streamlit platform team can update or refresh the build image to fix it.
The best workaround is what you’ve already done: temporarily remove or empty packages.txt to skip the apt step, allowing your app to deploy (but without system packages like tesseract-ocr). Once the Streamlit team refreshes the build image or the Debian mirror updates, you can restore packages.txt and redeploy. This issue has occurred before and is typically resolved by the platform maintainers without user intervention. For more details and community discussion, see this forum thread and the official docs on apt dependencies.
Sources: