I found the cause:
the system claimed that:
E [21/May/2025:07:44:23 -0100] "/@unixroot/var/run/cups/certs" is not a directory.
That was obviously wrong as this directory does exist and in fact, it is a directory. It turned out that this directory was "contaminated" with the usual Unix EA crap (UID, GID, MODE, etc.). Once I completely removed all EAs from the directory, I was able to properly update CUPS.
Sigh ...