Why do previous versions of Debian packages vanish in the package repositories? (highly relevant for version-controlled system configuration)

Being able to reproduce a specific setup, down to the exact version, is your requirement, not Debian’s.

Debian only supports a single version of each binary package in any given release; the counterpart of that is that great care is taken to ensure that package updates in any given release don’t introduce regressions, and when such care isn’t possible, to document that fact. Keeping multiple versions of a given package would only increase the support burden and the test requirements: for example, package maintainers would have to test updated packages against all available versions of the libraries they use, instead of only the currently-supported versions... Packages are only updated in a stable release when really necessary, i.e. to fix a serious bug (including security issues). In the kernel’s case, this sometimes means that the kernel ABI changes, and the package name changes as a result of that (to force rebuilds of dependent packages); there are meta-packages which you can pull in instead of hard-coding the ABI (linux-image-amd64, linux-headers-amd64, etc.).

There is however a workaround for your situation: every published source and binary package is archived on snapshot.debian.org. When you create a versioned setup, you can pick the corresponding snapshot (for example, one of the September 2019 snapshots) and use that as your repository URL:

deb https://snapshot.debian.org/archive/debian/20190930T084755Z/ buster main

If you end up relying on this, please use a caching mirror of some sort, for example Apt-Cacher NG. This will not only reduce the load on the snapshot server, it will ensure that you have a local copy of all the packages you need.

(The situation with regards to source packages is slightly more complex, and the archives do carry multiple versions of some source packages in a given release, because of licensing dependencies. But that’s not relevant here. Strictly speaking, Debian does provide multiple versions of some binaries in supported releases: the current version in the current point release, along with any updates in the security repositories and update repositories; the latter are folded in at the next point release. So maintaining a reproducible, version-controlled system configuration is feasible without resorting to snapshots, as long as you update it every time a point release is made.)

Don't rely on servers not under your control to reproduce a specific system state. Even thought the Debian servers are pretty reliable, you never know what could happen in the future. This is especially relevant with other repositories, you might use.

You should maintain your own mirror to get reproduce able system states. This way you can even have a production state for your normal systems and several testing states for new configurations.

The repository management tool aptly is able to create mirrors of repositories. You can choose the packages to mirror, create snapshots of repository contents at a specific points in time and combine several mirrors or snapshots into one repository. This way you can have completely reproduce able system states.

While Stephen Kitt's answer certainly is one possible solution, I think it would be safer for you to keep your own copies of the needed packages.

When recording a system setup, make sure to save copies of the .deb-files from /var/cache/apt/archives/. You can also use apt-get download.

When restoring a system setup, you have to be very strict with apt to avoid triggering potentially dangerous automatic actions.

It will probably be easier to use dpkg directly to install exactly what you want.