daedalus does have contrib non-free and non-free-firmware but it does not yet have daedalus-security or daedalus-updates. Those will come when daedalus is released.

At first I was thinking maybe you could see the contents of the file with zless or hexedit, but a little searching reveals that it contains a FAT filesystem. In that case, you might be able to mount it. Try fdisk -l xyz.db to figure out what the offset is. (sector size X start sector)

Maybe...
mount -o loop,offset=$OFFSET xyz.db /mnt

I really don't know. What's on lines 93 and 194 of debian/rules?

Yes, I went directly from debian wheezy to devuan jessie. If I remember correctly, going from debian jessie to devuan jessie was more difficult.

I did it about six months ago, and it went smoothly. That was on a system with lvm on top of raid1. Not encrypted.

Change /etc/apt/sources.list to contain the following (remove 'contrib' and 'non-free' if you don't use those.)

deb http://archive.devuan.org/merged jessie main contrib non-free
deb http://archive.devuan.org/merged jessie-security main contrib non-free

Then run

apt-get update
apt-get --allow-unauthenticated install devuan-keyring

If that doesn't work, you might need to download the deb package and install it with dpkg.

wget https://pkgmaster.devuan.org/devuan/pool/main/d/devuan-keyring/devuan-keyring_2022.11.15_all.deb
dpkg -i devuan_keyring_2022.11.15_all.deb

apt-get update
apt-get upgrade
apt-get dist-upgrade

If you don't have the kernel metapackage installed, you'll need to install whatever is the latest kernel for jessie. That will happen automatically if linux-image-amd64 or linux-image-686-pae is installed.

If you have some desktop other than xfce, it might be more difficult.

You can use "--include" and/or "--exclude" with debootstrap. See the man page for more options.

You could also make a script with "apt install <package1> <package2>..." that you copy to the installed system and run when you enter the chroot.

I don't understand your question about localization. You could exclude the locales package, but then you won't be able to set a different language.

It's very unlikely that we'll do it. You could backport it or you could probably download and install the version from mx that was made for the same version of debian that matches the devuan you're running.

Yes, it's possible to run without dbus. I made some no-dbus live isos a few years ago and posted about it here:
https://dev1galaxy.org/viewtopic.php?id=2158

There are links to my experimental isos, to lists of software that work without dbus, and probably some other good stuff.

Eliminating just dbus is not too difficult. I ditched xfce for openbox with lxpanel and lxterminal. No display manager, but in a live-iso it logs in automatically to desktop anyway. If installed, you would need to use startx.

If you want to eliminate all dbus libraries, then you become very limited. In that case, you might want to recompile some things so that they did not rely on those libs. It's probably not worth the effort to do that. The dbus libraries shouldn't be doing anything without dbus installed and running.

This is not my daily driver, but I do boot the live system for some online tasks that I don't want to do with my main system.

If you boot a live-usb, refractainstaller will install the running system. It doesn't need to ask for an iso.

~/.cache is in the rsync excludes list. If yours got copied, then something is wrong. Check the excludes list - /usr/lib/refractasnapshot/snapshot_excludes.list and make sure other excluded items did not get copied. Add anything else here that you want excluded.

In the config file, /etc/refractasnapshot.conf are some options for using compression to make the iso file smaller. You might want to uncomment one of them if you have not already done so. (look for mksq_opt)

You should be able to install to a partition on another usb stick just the same as if you installed to a partition on a hard disk.

I would make a plain backup of my important files without trying to squeeze them into an iso file.

Make sure you have a line for chimaera-security in /etc/apt/sources.list

deb http://deb.devuan.org/merged chimaera-security main

You can add 'contrib' and 'non-free' to the end of that line if you have those repos enabled on your other line(s).

Post your sources.list here if you're not sure.

Both accounts should have been copied into the iso, but the default setting is to boot to the primary user (uid:gid 1000:1000).

To boot to the other user with the iso you already made, edit the boot screen to add username=<whatever the other user's name is>
(Press TAB to edit bios boot menu, press e to edit uefi boot menu)

To make an iso that  boots to the second user by default, edit /etc/refractasnapshot.conf to set the desired username.