Repair wp/6.3 branch Actions: Fix wp-env Docker builds broken by archived Debian Buster/Bullseye repositories and expired Debian Stretch signing keys

[desrosj]

What?

Repairs wp-env's generated Dockerfile (packages/env/lib/init-config.js) so it can still build images for every PHP version this branch supports, across all three now-archived Debian releases:

Suite	PHP versions affected	Change
Buster	7.1, 7.2	Cherry-picks upstream #70718, rewriting deb.debian.org/security.debian.org to archive.debian.org and dropping buster-updates.
Bullseye	7.3, 7.4, 8.0	Cherry-picks upstream d21304e3323571401364805242fc26d1cf03a52d (#82478), rewriting the suite to archive.debian.org and dropping bullseye-security/bullseye-updates — the security suite is not on the archive host, so it is removed rather than redirected.
Stretch	5.6, 7.0	Adds a conditional apt.conf.d override allowing unauthenticated packages. The host rewrite for Stretch already existed on this branch, but archive.debian.org's own Stretch signing keys have fully expired, so apt-get -qy install $PHPIZE_DEPS still fails with E: There were unauthenticated packages and -y was used without --allow-unauthenticated.

A final commit records all three in packages/env/CHANGELOG.md.

Why?

Debian moves a release's package repositories to its archive server once that release reaches end-of-life, and drops them from the regular mirrors. wp-env start's Docker build then fails with apt-get 404s for any PHP version whose base image relies on an archived release. Stretch and Buster are already gone from deb.debian.org; Bullseye's rewrite is preemptive, and archive.debian.org already serves it.

wp-env imposes no PHP allowlist — checkVersion() in packages/env/lib/config/validate-config.js only checks the shape of the string, which is then interpolated straight into FROM wordpress:php${version}. The effective range is therefore this branch's Requires PHP floor of 5.6 up to whatever wordpress:php* tags exist. All three suites above fall inside that range.

The test-php matrix (7.0, 7.4, 8.0, 8.2) exercises Stretch and Bullseye but not Buster, so the Buster rewrite is not observable from this branch's CI alone. It is still required: packages/env/README.md on this branch uses "phpVersion": "7.2" as its worked example, and that value resolves to a Buster image.

The Stretch override is scoped to take effect only when the Stretch suite is actually present in /etc/apt/sources.list — matching how the per-suite sed rewrites are scoped by suite name rather than by PHP version — so Buster, Bullseye and any newer Debian-based build are unaffected.

Use of AI Tools

This PR was authored with the help of Claude Code. All code should be treated as AI-produced and not yet reviewed by a human until this PR is marked Ready for Review.

[desrosj]

Moved to WordPress#83706. The branch is left in place.