I can confirm updating the microcode by installing the intel-microcode
package and rebooting does indeed mitigate this issue. An LXC container
that was previously bricked due to update now starts and seems to behave
fully normally.
[ 0.000000] microcode: microcode updated early to revision 0x28, date
= 2019-11-12
But as microcode update needs to be loaded every time on boot (unless I
presumably updated the UEFI), while it technically solves my problem on
this installation, the concern of people with the same family of
processors and outdated microcode running into this issue and having no
idea why any Linux does not want to boot anymore still probably
remains... (is there even any easy way to load updated microcode while
installing Debian? I can most certainly bet its ISO does not include
those due to non-free constraints)