Function psql_invocation 

pub fn psql_invocation(conn: &PgConnection, sql: &str) -> SqlInvocation

Build a psql invocation that runs one trusted, we-generate-it DDL/utility statement (inc2 Stage C). This is the SUPERUSER / maintenance side of the atomic-shadow split: it runs ONLY our own generated control SQL — CREATE DATABASE <shadow>, pg_terminate_backend, the ALTER DATABASE … RENAME swap, DROP DATABASE — never a byte of the attacker-crafted bundle dump (that is applied by pg_restore_shadow_invocation as the NON-superuser target role).

sql is placed in argv (via -c): it is a constant/identifier-composed statement WE build (never a credential, never bundle-derived data), so argv is correct here — the only secret, the password, still rides in PGPASSWORD (the env), never argv. -v ON_ERROR_STOP=1 makes a failed statement a non-zero exit (so the driver never mistakes a failed CREATE DATABASE for success), and -tAc keeps any output terse. The caller runs one statement per invocation because CREATE DATABASE / ALTER DATABASE … RENAME cannot run inside a transaction block and psql wraps a multi-statement -c string as one implicit transaction. The connect target (incl. the maintenance postgres database for CREATE/ALTER/DROP DATABASE) rides in conn.env.