LibreWolf doesn’t work to give you a non-unique fingerprint. Use Mullvad Browser for that (without changing anything other than the safety level).
Don’t use a VPN with Tails. You could try something like https://github.com/PJ-Singh-001/Cubic to roll your own custom Ubuntu ISO, or you can just install another Linux distro on it which is what I recommend. Don’t forget to enable disk encryption because you can’t reliably wipe data from flash storage.



First-party stuff from your system package manager (things you install from the official repos with APT) are pretty much guaranteed to be safe. But the Snap Store (which uses snaps instead of flatpaks and is not installed by default on Debian) has unknowingly allowed and distributed malicious apps before. Flathub with flatpaks (which I think is enabled by default on Debian) hasn’t had such issues to this day AFAIK, but I would still be skeptical of stuff I install from there, and just not install apps with the Unverified badge on Flathub.
In the case of flatpaks, Flathub shows what permissions an app requests and gives it a kind of arbitrary safety level on its page:
You can click on it to see more information:
You can also use Flatseal to disallow any flatpak app from having certain permissions that you think it doesn’t deserve having.