This is what was causing the problem, in /etc/apt/apt.conf:
APT::Default-Release "hardy";
I put that in so I wouldn't accidentally get packages from hardy-backports except when I explicitly asked for them, but I guess it was also blocking hardy-security, which was definitely not the intent.
So this was my error, not a packaging bug; Mackenzie helped me set up pinning so I could set priorities for hardy-security and hardy-updates as well as hardy. Thanks!
This is what was causing the problem, in /etc/apt/apt.conf: Release "hardy";
APT::Default-
I put that in so I wouldn't accidentally get packages from hardy-backports except when I explicitly asked for them, but I guess it was also blocking hardy-security, which was definitely not the intent.
So this was my error, not a packaging bug; Mackenzie helped me set up pinning so I could set priorities for hardy-security and hardy-updates as well as hardy. Thanks!