[actions] WSL: pin every distribution, and test the newest of each line

The Ubuntu entries were pinned but `Debian` and `Alpine` were floating
aliases, so what those jobs tested drifted whenever the action updated.

Every line now carries a pin and the newest release setup-wsl offers for
it: Debian 12 and 13, Ubuntu 18.04, 20.04 and 24.04, Alpine 3.17 and 3.23.
`Alpine-3.17` is the image the unofficial jobs already ran, named
explicitly. Debian's pin is 12 rather than 11 because `Debian` and
`Debian-11` share a floating `aka.ms/wsl-debian-gnulinux` redirect and so
cannot be held still at all, where `Debian-12` is an immutable
salsa.debian.org artifact. The Debian-only steps key off `startsWith`, so
both Debian entries take the same path and moving a pin will not strand them.

There is no floating "newest" name to use instead: `kali-linux` is the only
unversioned distribution left, and setup-wsl's own CI disables
`additional-packages` on it. The newest only moves when the action's major
does, so the `uses:` ref is the thing to keep current.

Which is the other half of this: move that ref from v6 to v7. v6 is a dead
major, five months stale at v6.1.0 with no v6.2.0 and v7.0.0 tagged the next
day, so new distributions will only ever appear on v7 and later. v7's only
removals are the deprecated bare `Debian` and `Alpine`, which pinning has
already stopped using, and every name here is valid on both. It also drops
the Node.js 20 deprecation warning each WSL job currently emits, and it
tightens two pins that v6 left floating: Ubuntu 20.04 moves from
`aka.ms/wslubuntu2004` to a 20.04.6 image on releases.ubuntu.com, and 24.04
to a 24.04.4 one. Six of the seven platforms are now immutable artifacts;
Ubuntu 18.04 predates the format and still redirects through aka.ms.

Choosing a supported Debian also settles the 404s that had been failing
every Debian job: bullseye left LTS on 2026-08-31 and its security suite is
between homes, with `security.debian.org` still publishing an index whose
pool is being pruned and `archive.debian.org` carrying no `debian-security`
for bullseye yet. bookworm is on live mirrors, so `ca-certificates` is
current again, which matters for a job whose whole purpose is to fetch nvm
and node over TLS.

To keep a pin working once its release ages out in turn, derive sources.list
from the image's own codename and list every layout a release passes through:
main and security move to the archive on separate schedules, and the security
suite is renamed to `<codename>/updates` on the way. `apt-get update`
discards whichever entries 404, and where an index outlives its pool we fall
back once to main alone. Debian 13 moved to deb822, so clear both formats
first and leave what we write as the only thing apt reads.

Drop the blanket `apt-get upgrade` with it: it fetched 77 packages the test
never uses, and `apt-get install` already takes the newest version any
working mirror offers.

.github/workflows/windows-npm.yml

@@ -107,10 +107,15 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
+        # each line gets a pin, plus the newest setup-wsl offers for it; the
+        # newest only moves when the action's major does, so bumping the `uses:`
+        # ref below is what keeps this current
         wsl-distrib:
-          - Debian
-        # - Alpine # fails
+          - Debian-12
+          - Debian-13
+        # - Alpine-3.17 # fails
           - Ubuntu-20.04
+          - Ubuntu-24.04
           - Ubuntu-18.04
         npm-node-version:
           - '--lts'
@@ -128,31 +133,57 @@ jobs:
           - wsl-distrib: Ubuntu-18.04
             npm-node-version: '18'
           # node v24+ doesn't work on WSL1 (exec format error)
-          - wsl-distrib: Debian
+          - wsl-distrib: Debian-12
+            npm-node-version: '--lts'
+          - wsl-distrib: Debian-13
             npm-node-version: '--lts'
           - wsl-distrib: Ubuntu-20.04
             npm-node-version: '--lts'
+          - wsl-distrib: Ubuntu-24.04
+            npm-node-version: '--lts'
         method:
           - ''
           - 'script'
     steps:
       # For Ubuntu: install with packages directly
-      - if: matrix.wsl-distrib != 'Debian'
-        uses: Vampire/setup-wsl@v6
+      - if: ${{ !startsWith(matrix.wsl-distrib, 'Debian') }}
+        uses: Vampire/setup-wsl@v7
         with:
           distribution: ${{ matrix.wsl-distrib }}
           additional-packages: bash git curl ca-certificates wget
 
-      # For Debian: install without packages first (apt-get update fails due to stale sources.list)
+      # For Debian, install without packages: `additional-packages` would run
+      # `apt-get update` before we get to fix up sources.list
       # see https://github.com/Vampire/setup-wsl/issues/76
-      - if: matrix.wsl-distrib == 'Debian'
-        uses: Vampire/setup-wsl@v6
+      - if: ${{ startsWith(matrix.wsl-distrib, 'Debian') }}
+        uses: Vampire/setup-wsl@v7
         with:
           distribution: ${{ matrix.wsl-distrib }}
-      - if: matrix.wsl-distrib == 'Debian'
+      # Debian's mirror layout shifts as a release ages out of LTS: main moves to
+      # archive.debian.org, and the security suite is both renamed and moved, on
+      # its own schedule. Offer every layout and let `apt-get update` discard the
+      # ones that 404, so this needs no edits as the image's release ages.
+      - if: ${{ startsWith(matrix.wsl-distrib, 'Debian') }}
+        name: 'Point apt at whichever mirrors still carry this release'
         shell: 'wsl-bash {0}'
-        run: 'sed -i s/ftp.debian.org/archive.debian.org/ /etc/apt/sources.list'
-      - if: matrix.wsl-distrib == 'Debian'
+        run: |
+          codename="$(. /etc/os-release && printf '%s' "${VERSION_CODENAME-}")"
+          if [ -z "${codename}" ]; then
+            echo 'no VERSION_CODENAME in /etc/os-release' >&2
+            exit 1
+          fi
+          # Debian 13 moved to deb822; drop both formats so what we write is the
+          # only thing apt reads, whichever release is pinned
+          rm -f /etc/apt/sources.list.d/*.list /etc/apt/sources.list.d/*.sources
+          {
+            echo "deb http://deb.debian.org/debian ${codename} main"
+            echo "deb http://archive.debian.org/debian ${codename} main"
+            echo "deb http://security.debian.org/debian-security ${codename}-security main"
+            echo "deb http://archive.debian.org/debian-security ${codename}-security main"
+            echo "deb http://archive.debian.org/debian-security ${codename}/updates main"
+          } >/etc/apt/sources.list
+          cat /etc/apt/sources.list
+      - if: ${{ startsWith(matrix.wsl-distrib, 'Debian') }}
         name: 'Install packages with retries'
         shell: 'wsl-bash {0}'
         run: |
@@ -173,9 +204,15 @@ jobs:
               }
             done
           }
-          retry apt-get update
-          retry apt-get upgrade --yes
-          retry apt-get install --yes bash git curl ca-certificates wget
+          packages=(bash git curl ca-certificates wget)
+          retry apt-get update || true
+          if ! retry apt-get install --yes "${packages[@]}"; then
+            # a security index can outlive the pool objects it advertises, which
+            # no retry resolves; main is complete once a release is archived
+            sed -i '/debian-security/d' /etc/apt/sources.list
+            retry apt-get update || true
+            retry apt-get install --yes "${packages[@]}"
+          fi
 
       - name: Retrieve nvm on WSL
         run: |
@@ -204,7 +241,8 @@ jobs:
       fail-fast: false
       matrix:
         wsl-distrib:
-          - Alpine
+          - Alpine-3.17
+          - Alpine-3.23
         npm-node-version:
           - '--lts'
           - '21'
@@ -218,7 +256,7 @@ jobs:
           - ''
           - 'script'
     steps:
-      - uses: Vampire/setup-wsl@v6
+      - uses: Vampire/setup-wsl@v7
         with:
           distribution: ${{ matrix.wsl-distrib }}
           additional-packages: bash git curl ca-certificates wget