add section on puppet upgrades

howto/puppet.md

@@ -1438,6 +1438,19 @@ Then restart `puppetserver.service`.
 Starting from `trixie`, the `trocla-puppetserver` package will be available to
 replace this manual deployment of the `trocla` gem.
 
+## Upgrades
+
+Puppet upgrades can be involved, as backwards compatibility between
+releases is not always maintained. Worse, newer releases are not
+always packaged in Debian. TPA, and @lavamind in particular, worked
+really hard to package the Puppet 7 suite to Debian, which finally
+shipped in Debian 12 ("bookworm"). Lavamind also packaged Puppet 8 for
+trixie.
+
+See [issue 33588][] for the background on this.
+
+[issue 33588]: https://gitlab.torproject.org/tpo/tpa/team/-/issues/33588
+
 ## SLA
 
 No formal SLA is defined. Puppet runs on a fairly slow `cron` job so