Test against dependencies, CI images, etc., from testing, by default

In my projects I like to follow the Not Rocket Science Rule Of Software Engineering: "Automatically maintain a repository of code that always passes all the tests."

Forge CI can be a part of that. But, that means that the inputs to each test must all be controlled somehow. Otherwise, breaking changes elsewhere can break CI. Then the Rule is violated and we're doing rocket science to figure out whether we ought to be overriding CI.

ci.debian.net controls admission to Debian testing. So if we run all our tests against Debian testing, rather than Debian unstable, we can follow the Not Rocket Science Rule.

If our project is afflicted by some kind of breakage as a result of an update to a dependency, our formal autopkgtests run in ci.debian.net will stop that migrating until we (Debian collectively) have prepared a combination of versions that will pass the tests.

But that preparation work becomes complicated - even, blocked - if our Salsa CI tests pull in things from Debian unstable. We can't merge preparatory MRs, for example. Unrelated work on our package is blocked. (Unless we want to override the CI failure and take up Rocket Science.)

So I think by default Salsa CI ought to pull in dependencies from testing. There should be no jobs in the default pipeline that pull from unstable (except maybe ones marked allow_failure).

I appreciate that this would be a big change, so a discussion about it will be warranted. I certainly don't understand all the project-wide ramifications of such a change.

In the meantime I set DEFAULT_RELEASE in our project's YAML, but I was surprised to find that I also needed to override the autopkgtest job with a bespoke RELEASE setting. (dgit-team/dgit!357 (merged)) IDK if that would be worth a separate ticket.