[jaydreyer]

Summary

• mark the static PostgreSQL rds.force_ssl parameter as pending-reboot
• add a Terraform architecture assertion preventing the post-create perpetual diff
• preserve the approved private, deletion-protected off-state database configuration

Verification

• terraform validate
• terraform test (5 passed)
• live Terraform reconciliation against the provisioned AWS demo environment: no changes

Deployment context

The approved safe off-state infrastructure apply completed with 83 resources added, zero changed, and zero destroyed. AWS normalized rds.force_ssl to pending-reboot during creation; this change makes configuration match the provider and live resource behavior before the protected deployment workflow runs.