[evand]

I think snaps + Debian stable could be that solution. You get the stability of Debian at the system level with the reliability of app updates from snaps.

Bad updates automatically roll back, and you can subscribe to a risk level at a per-application level (https://www.youtube.com/watch?v=-3b9qkl9Z_k).

As well, because snaps bundle their dependencies you don't have that problem you mention of adding a repo and getting busted library versions.