> I really wish, though, that package managers were more capable of differentiating between security and feature upgrades. If they were, we could run a rolling distro in “Debian mode” at will.

This is exactly the sweet spot that Gentoo hits for me. The default configuration will install only "stable" packages, which are bumped ASAP for security reasons, but you're always free to switch a selection of (or all packages) to their "unstable" variants. Thanks to its source compiled nature, doing this is never a "partial upgrade", and is very well supported. Even if you use Gentoo as a binary distribution, portage is extremely meticulous in ensuring version compatibility.

And Gentoo can also be based on musl (experimental). I tried it for a while on a SBC, but arm (32bit) is not well supported in Gentoo and musl on arm is almost unusable, like ... completely abandoned.