feat: build the guest agent's engine from the image it is baked into

Define the composite engine interface and a newEngine() factory keyed by a per-engine layout table, so the agent's defaults, health probe and command implementation all come from the engine the image bakes rather than from PostgreSQL-shaped constants. Rename PGBin/PGData/PGUser to EngineBinDir/EngineDataDir/EngineUser, delete PGIsReady, and give engineProbe an injected state function with the pg_isready exit-code mapping moved into the PostgreSQL implementation.

setup.sh now stamps /etc/spinifex-rds/engine and buildAgentUserData emits RDS_ENGINE. The agent compares the two after registering and refuses to run when they disagree, reporting unhealthy before the bootstrap handoff is written so rds-init never unblocks and no datadir is touched.

scripts/images/rds-postgres/rds-agent.initd

@@ -35,8 +35,8 @@ start_pre() {
         # shellcheck disable=SC1090
         . "${AGENT_ENV}"
         export RDS_GATEWAY_URL RDS_GATEWAY_CA RDS_REGION RDS_DB_INSTANCE_IDENTIFIER \
-            RDS_ENGINE_VERSION RDS_HANDOFF_DIR RDS_ENGINE_HOST RDS_ENGINE_PORT \
-            RDS_PG_ISREADY RDS_POLL_WAIT RDS_DATA_MOUNT
+            RDS_ENGINE RDS_ENGINE_VERSION RDS_HANDOFF_DIR RDS_ENGINE_HOST RDS_ENGINE_PORT \
+            RDS_POLL_WAIT RDS_DATA_MOUNT
     fi
 }
 

scripts/images/rds-postgres/rds-agent_initd_test.sh

@@ -9,7 +9,10 @@ source_time_handoff="${CASE}/source-time"
 configured_handoff="${CASE}/configured"
 mkdir -p "${configured_handoff}"
 touch "${configured_handoff}/bootstrap.env"
-printf 'RDS_HANDOFF_DIR=%s\n' "${configured_handoff}" >"${CASE}/agent.env"
+{
+    printf 'RDS_HANDOFF_DIR=%s\n' "${configured_handoff}"
+    printf 'RDS_ENGINE=postgres\n'
+} >"${CASE}/agent.env"
 
 # Simulate OpenRC sourcing the service before start_pre loads agent.env.
 export RDS_HANDOFF_DIR="${source_time_handoff}"
@@ -34,5 +37,12 @@ if [ "${EEND_STATUS}" != "0" ]; then
     echo "FAIL: post-start wait did not find the configured handoff" >&2
     exit 1
 fi
+# The agent checks this against the engine its own image bakes. Left out of the
+# export list it would read as no assertion at all, so a VM launched as the
+# wrong engine would bootstrap instead of refusing.
+if [ "${RDS_ENGINE:-}" != "postgres" ]; then
+    echo "FAIL: start_pre did not export RDS_ENGINE from agent.env" >&2
+    exit 1
+fi
 
 echo "rds-agent.initd: all tests passed"

scripts/images/rds-postgres/rds-engine-stamp_test.sh

@@ -0,0 +1,30 @@
+#!/bin/sh
+set -eu
+
+# The engine this preset bakes is stated in three places that have to agree: the
+# stamp setup.sh writes, the manifest tag resolveEngineAMI selects on, and the
+# name rds-agent's layout table is keyed by. A drift between them launches the
+# wrong image or refuses the right one.
+
+SCRIPT_DIR=$(CDPATH='' cd -- "$(dirname -- "$0")" && pwd)
+REPO_ROOT=$(CDPATH='' cd -- "${SCRIPT_DIR}/../../.." && pwd)
+ENGINE="postgres"
+
+stamped=$(sed -n "s|^printf '\\(.*\\)\\\\n' > /etc/spinifex-rds/engine\$|\\1|p" "${SCRIPT_DIR}/setup.sh")
+if [ "${stamped}" != "${ENGINE}" ]; then
+    echo "FAIL: setup.sh stamps engine '${stamped}', want '${ENGINE}'" >&2
+    exit 1
+fi
+
+if ! grep -q "engine=${ENGINE} " "${SCRIPT_DIR}/manifest.conf"; then
+    echo "FAIL: manifest.conf SYSTEM_TAG does not carry engine=${ENGINE}" >&2
+    grep '^SYSTEM_TAG' "${SCRIPT_DIR}/manifest.conf" >&2
+    exit 1
+fi
+
+if ! grep -q "enginePostgres = \"${ENGINE}\"" "${REPO_ROOT}/cmd/rds-agent/engine.go"; then
+    echo "FAIL: rds-agent does not implement an engine named ${ENGINE}" >&2
+    exit 1
+fi
+
+echo "rds-engine-stamp: all tests passed"

scripts/images/rds-postgres/setup.sh

@@ -22,6 +22,13 @@ rc-update add mulga-mgmt-net boot
 # so the delivery lands in a root-only directory.
 install -d -m 0700 /etc/spinifex-rds
 
+# The engine this image bakes. rds-agent builds its engine implementation from
+# this file, so running the wrong implementation is structurally impossible
+# rather than merely validated against; a VM launched as another engine is
+# refused before anything touches the datadir.
+printf 'postgres\n' > /etc/spinifex-rds/engine
+chmod 0444 /etc/spinifex-rds/engine
+
 # Empty in the image: rds-datadir mounts over it at boot. Postgres-owned so the
 # engine can traverse it if the volume's own root is stricter.
 install -d -m 0750 -o postgres -g postgres /var/lib/postgresql