Dawkins talks about this in The Blind Watchmaker, calling it cumulative selection (not sure where else this term is used). It's hard to wrap my head around, but that also makes sense given that our intuition is not adapted for such large numbers. Considering how long the time scale is, how many mutations are discarded, the driving force of survival, and probably other factors I'm forgetting, it's not that surprising we end up with a small (relative to the combinatorial possibilities) number of configurations. But again, I do still feel like I'm trying to convince myself right now, even though when I read the (better written) explanations, it makes sense in that moment.
Why not keep the same docker image throughout then lifecycle? E.g. merge to dev branch, trigger ci (build image at this point), maybe deploy to a test environment, run more tests, then deploy to prod. No chance of packages changing since the image isn't rebuilt. Of course if not using docker, a lock file (i.e. actual dependency resolution) would seem essential for reproducibility.