Repair wp/7.1 branch Actions: Point the bullseye security apt sources at archive.debian.org - #85485

Part of #82781.

What?

Backports #85469 to this branch's wp-env: the bullseye-security apt sources of the bullseye-based WordPress images (PHP 7.3, 7.4, and 8.0) now point at archive.debian.org instead of being deleted.

Why?

When #82478 was written, bullseye-security was not on archive.debian.org yet, so it was dropped rather than rewritten. That change is already on this branch. The archive has served the suite since 2026-09-12 (http://archive.debian.org/debian-security/dists/bullseye-security/Release). While the suite is dropped, images built by wp-env install packages without Debian's security updates. For example, libc6 resolves to 2.31-13+deb11u11 from bullseye instead of 2.31-13+deb11u14 from bullseye-security.

This was raised in review of the wp/6.9 backport of #82478 (#82873 (comment)). The same fix was added to the wp/7.0 through wp/6.3 stacks in the pull requests that already handle the bullseye apt sources. wp/7.1 has no such pull request, because #82478 was already on the branch (3b49e92). #85469 will not be backported to wp/7.1 now that wp/7.2 exists, so this pull request adds the fix to the stack, in the same position as the bullseye pull requests on the other branches: above pin-runner-images (#82792) and below pin-wp-env-core-version (#82791).

How?

Same change as #85469 in packages/env/lib/runtime/docker/docker-config.js:

• Replaces the /bullseye-security/d deletion with two rewrites, matching how the stretch and buster security suites are already handled. Both are needed because the images do not agree on the host: wordpress:php7.3 uses security.debian.org/debian-security, and wordpress:php7.4 and wordpress:php8.0 use deb.debian.org/debian-security.
• Removes the outdated comment saying the security suite is not on the archive yet. bullseye-updates is still dropped, as buster-updates and stretch-updates are.
• Adds the changelog entry from wp-env: Keep Debian security updates in Bullseye-based images #85469.

Testing Instructions

1. In a directory with a .wp-env.json that sets "phpVersion": "7.3", run node /path/to/gutenberg/packages/env/bin/wp-env start using this branch's checkout. Repeat with "7.4" and "8.0".
2. Confirm each image builds without apt-get errors.
3. Run node /path/to/gutenberg/packages/env/bin/wp-env run cli cat /etc/apt/sources.list and confirm the bullseye-security line points at archive.debian.org/debian-security.

Use of AI Tools

This PR was created by Claude Code under my supervision. All code should be treated as AI-produced and not yet reviewed by a human until this PR is marked Ready for Review.

🤖 Generated with Claude Code