fix(consul-postgres-ha): role-watcher + set-e isolation in supervise loops

Two related fixes:

1. **Role watcher**: service-resolver subset filters in Connect EDS
   apply to the SIDECAR registration's Tags, not to the parent
   service's tags (Patroni's stage4 instance tags don't propagate
   to the postgres-sidecar-proxy registration). Added a polling
   loop in entrypoint.sh that watches Patroni's REST API at
   `127.0.0.1:8008/` and re-PUTs the postgres-sidecar registration
   with `Tags=["master"]` or `["replica"]` whenever Patroni's role
   changes. Initial registration starts with Tags=[]; the watcher
   fills it in within ~5s of Patroni REST coming up.

2. **Supervise-loop isolation**: each Envoy + the role-watcher run
   in a `(... &) | prefix` subshell. They inherited the outer
   entrypoint's `set -euo pipefail`, so a single failed `curl`
   (Patroni REST not yet up) or an Envoy crash (no Consul leader
   yet → bootstrap config can't be fetched) propagated as subshell
   exit → `wait -n` returned → container teardown cascade. Added
   `set +eo pipefail` at the start of each supervise subshell so
   the while-true retry loop survives expected transient failures.

This is what was missing for the first end-to-end Patroni-via-Connect
to fire: without role tags on the sidecar, postgres-master EDS
returns empty; without supervise-loop isolation, the first Envoy
crash kills the container.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: h4x3rotab

consul-postgres-ha/mesh-sidecar/entrypoint.sh

@@ -174,6 +174,7 @@ if [ "$ROLE" = "worker" ]; then
   "Name": "postgres-sidecar-proxy",
   "Address": "127.50.0.${SELF_VIP}",
   "Port": 21001,
+  "Tags": [],
   "Proxy": {
     "DestinationServiceName": "${CLUSTER_NAME}",
     "LocalServiceAddress": "127.0.0.1",
@@ -223,7 +224,12 @@ EOF
   # list, but the bootstrap config is fine). Webdemo registers its own
   # SidecarService block from webdemo/main.go; the bootstrap call
   # blocks until that registration is in place.
+  #
+  # `set +e` because envoy crashes mid-startup count as expected events
+  # the while loop handles by retrying — outer `set -e` would bubble
+  # them up as a "child exited" → container teardown.
   (
+    set +eo pipefail
     while true; do
       if consul connect envoy \
             -sidecar-for="webdemo-${PEER_ID}" \
@@ -242,6 +248,7 @@ EOF
   # Postgres Envoy supervise loop, same pattern. Bootstrap from the
   # standalone connect-proxy registration above.
   (
+    set +eo pipefail
     while true; do
       if consul connect envoy \
             -proxy-id="postgres-sidecar-${PEER_ID}" \
@@ -256,6 +263,43 @@ EOF
     done
   ) 2>&1 | prefix envoy-postgres &
   ENVOYS+=("$!")
+
+  # Role watcher: mirror Patroni's current role into the postgres-
+  # sidecar registration's Tags. Service-resolver subset filters
+  # (Service.Tags contains "master") apply to the SIDECAR registration,
+  # not to Patroni's parent service. So we poll Patroni's REST API
+  # (127.0.0.1:8008, shared via network_mode: host) and re-PUT the
+  # sidecar with Tags=["master"] / ["replica"] on role change. Patroni
+  # itself drives the role via its DCS leader-lock; this loop just
+  # mirrors that into a shape Connect EDS understands.
+  #
+  # Initial state: Tags=[] (the registration above). Until the watcher
+  # runs at least once, postgres-master and postgres-replica EDS
+  # return empty. The first iteration runs ~5s after Patroni REST
+  # comes up; consumers pre-watch will reconnect when EDS populates.
+  (
+    set +eo pipefail
+    PREV=""
+    while true; do
+      sleep 5
+      ROLE=$(curl -fsS --max-time 2 http://127.0.0.1:8008/ 2>/dev/null \
+              | jq -r '.role // empty' 2>/dev/null)
+      case "$ROLE" in
+        master|primary)               TAG="master"  ;;
+        replica|standby_leader|sync_standby) TAG="replica" ;;
+        *)                            continue ;;
+      esac
+      [ "$TAG" = "$PREV" ] && continue
+      jq --arg t "$TAG" '.Tags = [$t]' /tmp/postgres-sidecar.json \
+         > /tmp/postgres-sidecar.tagged.json
+      if curl -fsS -X PUT --data-binary @/tmp/postgres-sidecar.tagged.json \
+              http://127.0.0.1:8500/v1/agent/service/register; then
+        echo "[role-watcher] postgres-sidecar tag: $PREV -> $TAG (patroni role=$ROLE)"
+        PREV="$TAG"
+      fi
+    done
+  ) 2>&1 | prefix role-watcher &
+  ENVOYS+=("$!")
 fi
 
 # ---- 6. coordinator-0: write Connect config entries (idempotent) ----