decision on base for 2.0 reproducible build

[spoonincode]

As discussed, re-evaluate for 2.0; current options are

• Use unpinned base (like pre 1.2.2; and current 2.0 branch)
• Use pinned base (like post 1.2.2 on 1.x series)
• Use pinned base but also mirror the snapshot to our own store

Also probably also a decision on what specific Debian version to use as base.