fix: disallow reserved master names during rds password apply

scripts/images/rds-postgres/rds-init

@@ -98,9 +98,14 @@ load_handoff() {
     # The master role is created NOSUPERUSER, so a master named after the
     # bootstrap superuser would leave the cluster without one and strip rds-agent
     # of the privileged SQL it reaches over peer auth — unrepairable, since the
-    # datadir bootstraps once. The control plane reserves both names already.
-    case "${RDS_MASTER_USERNAME}" in
-        "${PG_USER}" | "${MASTER_GROUP_ROLE}")
+    # datadir bootstraps once.
+    #
+    # The same set the control plane reserves, matched the same way: anything it
+    # refuses must be refused here too, or the name reaches initdb, fails at role
+    # creation and spends the one-shot password on the way.
+    _master_lower=$(printf '%s' "${RDS_MASTER_USERNAME}" | tr '[:upper:]' '[:lower:]')
+    case "${_master_lower}" in
+        "${PG_USER}" | "${MASTER_GROUP_ROLE}" | rdsadmin | pg_*)
             fail "RDS_MASTER_USERNAME ${RDS_MASTER_USERNAME} is reserved by the platform; the control plane should have rejected it"
             ;;
     esac

scripts/images/rds-postgres/rds-init_test.sh

@@ -508,7 +508,9 @@ run_fails "no-handoff"
 # The master role is created NOSUPERUSER, so one named after the bootstrap
 # superuser would leave the cluster without a superuser at all and strip
 # rds-agent of the privileged SQL it needs — on a datadir that bootstraps once.
-for reserved in postgres rds_superuser; do
+# The set and the case-insensitive matching are the control plane's: a name it
+# refuses must not reach initdb here and spend the one-shot password.
+for reserved in postgres rds_superuser rdsadmin pg_toast_owner PostGres; do
     reset_state
     MASTER_USER="${reserved}"
     write_handoff initialize 's3cr3t' appdb