As a Toolforge administrator I want an automated system tracking Debian package versions installed in Toolforge containers so that I can make sure the images do not have any security updates pending.

Maybe Debmonitor? https://wikitech.wikimedia.org/wiki/Debmonitor