I did and the file I tested did not show any change before and after the sed command.
BUT then I marked that one in my vi and pasted it with the middle mouse button into the vi on another machine (remote terminal), assuming it would be "the same", which apparently is a wrong assumption, since with that move you get the mentioned spaces in the blank lines. That is most likely the reason why the file on my machine has a different file size than the one I pasted here.
Lesson learnt and again appoligies to mess this up.

That perhaps works easier as my long way around. Hope I remember the next time I need that knowledge

Did a bit of experimenting.
I just did a:

traceroute deb.devuan.org

several times, which gave me quite different results from
"nework not reachable" to
ending with the (default) 30 hops, with no reached server
and some quick responses, from which I picked the fastest one with the fewest hops.

then I searched this:
https://pkgmaster.devuan.org/mirror_list.txt
with the domain name of that reply.
I exchanged the found mirror with the "deb.devuan.org" in devuan.sources.

Now I get hits on all suits without any fail so far.

Maybe something in my WAN setup is blocking things (or my ISP does)

I just started the notebook, which I change to excalibur just a few days prior to the release.
So the new style devuan.sources there worked flawlessly in that process.

I did not change anything with that sources and now an apt-get update gives me

E: The repository '<any-of-the-non-secure-excalibur-repos> Release' no longer has a release  file.
N: Updating from such a repository can't be done securely, and is therefore disabled by default.

(sorry for not c&p this, it's only om tty0 of the other machine)

So still no idea how to fix this reliable.

EDIT: similar errors of other debian derivates mostly suggest missing/faulty repos.
Is there a way to find which actual repo I hit with:
(at any given run on it)

http://deb.devuan.org/merged
http://de.deb.devuan.org/merged

(of course only one of those are used in any attempt)

EDIT2 (after a bit of digging):

$ curl -Is http://deb.devuan.org/merged | head -1
HTTP/1.1 301 Moved Permanently
$ curl -Is http://de.deb.devuan.org/merged | head -1
HTTP/1.1 301 Moved Permanently

As I understand it, that should be "200"
But then: why does it get the security updates and not the others?

OK, maybe there is something strange.
As I disabled the daedalus sources, it looked like this:

root@kamin:~# ls -l /etc/apt/ |grep sources
-rw-r--r-- 1 root root    0 Mar  9  2024 sources.list~
drwxr-xr-x 2 root root 4096 Nov  5 19:30 sources.list.d
-rw-r--r-- 1 root root 1358 Jul  7  2024 sources.list_daedalus

I just checked it again on a hunch:

root@kamin:~# ls -l /etc/apt/ |grep sources
-rw-r--r-- 1 root root    0 Nov  5 14:10 sources.list
-rw-r--r-- 1 root root    0 Mar  9  2024 sources.list~
drwxr-xr-x 2 root root 4096 Nov  5 19:30 sources.list.d
-rw-r--r-- 1 root root 1358 Jul  7  2024 sources.list_daedalus

Do I have a gap of knowledge here?
Where does the empty sources.list come from? Is that something generated from the sources.list~?

Anyways, deleting the two empty files, gives me:

root@kamin:~# ls -l /etc/apt/ |grep sources
drwxr-xr-x 2 root root 4096 Nov  5 19:30 sources.list.d
-rw-r--r-- 1 root root 1358 Jul  7  2024 sources.list_daedalus

And now I'm getting hits on all repos/suits. Just bugs me, that I don't get the whole picture here..

No.
But that wouldn't explain why it showed the same behaviour with the old style of the sources file.

PC was off over night, I now checked the devuan.sources file and I deleted and re-insert the blank lines.
Then I get a working update.

For testing I changed back to the short variant with all suites in one line (only excalibur-security in a separat stanza):
apt-get update, again, give me only security.

changing back to the previous working one, I still get only the security updates.

very un-deterministic

EDIT: quite often I get this behaviour (there was about 5sec between the error and the next execution of the command:

root@kamin:~# apt-get update 
Ign:1 http://de.deb.devuan.org/merged excalibur-security InRelease
Err:2 http://de.deb.devuan.org/merged excalibur-security Release
  404  Not Found [IP: 147.229.176.19 80]
Reading package lists... Done
E: The repository 'http://de.deb.devuan.org/merged excalibur-security Release' no longer has a Release file.
N: Updating from such a repository can't be done securely, and is therefore disabled by default.
N: See apt-secure(8) manpage for repository creation and user configuration details.
root@kamin:~# apt-get update 
Hit:1 http://de.deb.devuan.org/merged excalibur-security InRelease
Reading package lists... Done

EDIT2: reboot or halt -p do not change the situation, still only a hit on security packages.

As http://de.deb.devuan.org/ should be e repo pool: might there be some repos not up to date?

just to be sure: is that the point where you have to remove the install medium (guess that is to be done in VM/VirtualBox, too.)

As for the file: I would too, say those are clean text files.
BTW: it's the other was around with me: I do not get anĺong with nano (might be it is, that I'm used to vi since my first encounters with *nix systems in 1997, Solaris and IRIX in that case).

Seems I have to try the split version of the sources file on the new machine for reasons that might stay mysterious...

UPDATE:
splitting the file was in vain:

# Devuan 6 excalibur
## The new style method of using repositories to install software.
## This /etc/apt/sources.list.d/devuan.sources is new style and location file
## The /etc/apt/old.style.sources.list contains the same as this.
## https://linuxconfig.org/ubuntus-repository-configuration-ubuntu-sources-have-moved-to-etc-apt-sources-list-d-ubuntu-sources
 
## Normal excalibur sources
Types: deb
URIs: http://de.deb.devuan.org/merged
Suites: excalibur
Components: main non-free contrib non-free-firmware
Enabled: yes
Signed-By: /usr/share/keyrings/devuan-archive-keyring.gpg
Architectures: amd64
 
## backports excalibur sources
Types: deb
URIs: http://de.deb.devuan.org/merged
Suites: excalibur-backports
Components: main non-free contrib non-free-firmware
Enabled: yes
Signed-By: /usr/share/keyrings/devuan-archive-keyring.gpg
Architectures: amd64
 
## proposed-updates excalibur sources
Types: deb
URIs: http://de.deb.devuan.org/merged
Suites: excalibur-proposed-updates
Components: main non-free contrib non-free-firmware
Enabled: yes
Signed-By: /usr/share/keyrings/devuan-archive-keyring.gpg
Architectures: amd64
 
## updates excalibur sources
Types: deb
URIs: http://de.deb.devuan.org/merged
Suites: excalibur-updates
Components: main non-free contrib non-free-firmware
Enabled: yes
Signed-By: /usr/share/keyrings/devuan-archive-keyring.gpg
Architectures: amd64
 
## excalibur security sources
Types: deb
URIs: http://de.deb.devuan.org/merged
Suites: excalibur-security
Components: main non-free contrib non-free-firmware
Enabled: yes
Signed-By: /usr/share/keyrings/devuan-archive-keyring.gpg

still:

root@kamin:/etc/apt/sources.list.d# apt-get update
Hit:1 http://de.deb.devuan.org/merged excalibur-security InRelease
Reading package lists... Done

So both of the above work? (from post #9)
can you open it with vim to see if there any hidden CR/LF symbols?
EDIT:
My devuan.sources (generated by hand not with "apt mordernize-sources") is from a PC I did upgrade prior to the excalibur release (just a few days)
-on that machine, I get all sources with the "all suites in one line"

using the same file now on another machine gives the "only secure" result.

for testing I changed the URI to

 apt-get update  http://de.deb.devuan.org/merged
Get:1 http://de.deb.devuan.org/merged excalibur-security InRelease [37.9 kB]
Get:2 http://de.deb.devuan.org/merged excalibur-security/main amd64 Packages [69.8 kB]
Get:3 http://de.deb.devuan.org/merged excalibur-security/main Translation-en [47.3 kB]
Get:4 http://de.deb.devuan.org/merged excalibur-security/non-free-firmware amd64 Packages [548 B]
Get:5 http://de.deb.devuan.org/merged excalibur-security/non-free-firmware Translation-en [306 B]
Fetched 156 kB in 4s (40.9 kB/s)       
Reading package lists... Done

Still only security, but more hits?

renamed, which I meant by "disabled the daedalus sources"
Already did it that way with another machine.
Could it be, I need some cleanup from switchen the sources back and forth?

Strange thing is: Why does it get the security packages but not the normal packes from the same devuan.sources?