Okay just after posting I found another post with the same problem description and a first attempted solution: Install a package (and its dependencies) at specific date instead of specific version
I guess the main challenge is “how to not mess up the main Julia depot” when installing an older version of General registry. I wonder if we could avoid this problem by producing the desired Manifest.toml from the registry history, without actually installing the older registry, and then Pkg.instantiate that with the regular Julia depot/registry.