When investigating T239831 I noticed that recent stretch reimages were not using Puppet 5: https://debmonitor.wikimedia.org/packages/puppet
We need to fix the pinning (or stop using a separate component for Puppet 5 and just move it to stretch-wikimedia/main, but that might cause issues with Cloud VPS)