I'm surprised this didn't occur to me earlier, but we should generally run the builds inside containers themselves, so the host does not need to be Debian/have debootstrap around. There is one edge-case for bootstrapping, obviously you need an image to spawn builder containers from, but once you've got one, that's the exception rather than the rule.