On my laptop right now, it's failing to detect a bunch of stuff:

anarcat@angela:~$ apt-forktracer
tailspin (1.3.0+dfsg-1) [Debian: 1.3.0+dfsg-1+b1]
libnss3 (2:3.90-3) [Debian: 2:3.92-1 2:3.87.1-1]
pubpaste (0.8.5) [Debian: 0.8.4 0.8.3 0.8.3]

vs:

anarcat@angela:~$ apt list '?obsolete'
Listing... Done

... which, fair enough, is empty, buuut our more elaborate:

anarcat@angela:~$ apt list "?narrow(?installed, ?not(?codename($(lsb_release -c -s | tail -1))))"
Listing... Done
elpa-rg/experimental,now 2.3.0-1 all [installed]
firefox-esr/now 115.2.1esr-1 amd64 [installed,local]
github-backup/unstable,now 1.20200721-2+b1 amd64 [installed]
hopenpgp-tools/unstable,now 0.23.7-1 amd64 [installed]
libnss3/now 2:3.90-3 amd64 [installed,local]
libwlroots11/unstable,now 0.16.2-3 amd64 [installed]
linux-image-6.5.0-1-amd64/unstable,now 6.5.3-1 amd64 [installed]
poweralertd/unstable,now 0.2.0-1+b1 amd64 [installed]
pubpaste/now 0.8.5 all [installed,local]
python3-reedsolo/unstable,now 1.7.0-1+b1 amd64 [installed]
ripcalc/unstable,now 0.1.9-1+b2 amd64 [installed]
sway-notification-center/unstable,now 0.9.0-1 amd64 [installed]
sway/unstable,now 1.8.1-2 amd64 [installed]
tailspin/now 1.3.0+dfsg-1 amd64 [installed,local]
yt-dlp/unstable,now 2023.07.06-1 all [installed]

Works wonders!

That was actually suggested in the bookworm upgrade docs, and makes sense.

gcc is now at 10, so we remove 9 now

and we do get rid of python2

we're using sudo elsewhere, if we were not needing sudo, we should
remove it everywhere.