and according to my reverse-engineered deployment script, these are the two necessary actions, to emulate nixos-rebuild:

  deploy-ssh-for = {
    type = "app";
    program = toString (pkgs.writeScript "deploy-ssh-for" ''
      #!${pkgs.stdenv.shell}
      set -eux
      configName=$1
      remote=root@$2
      action=$3
      shift 3
      if [ gc = "$action" ]
      then ssh -C $remote nix-collect-garbage "$@"
           exit 0
      fi
      configuration=$(nix build .#nixosConfigurations.$configName.config.system.build.toplevel --print-out-paths --no-link -L)
      nix-copy-closure $(if [ "''${1-}" != --direct ]; then echo --use-substitutes; fi) --gzip --to $remote $configuration
      if [ dry-run = "$action" ]
      then set +x
           echo "[dry-run] Would run these commands:"
           echo "    ssh -C $remote nix-env --profile /nix/var/nix/profiles/system --set $configuration"
           echo "    ssh -C $remote $configuration/bin/switch-to-configuration $action"
      else if [ build = "$action" ]
      then ssh -C $remote nix-env --profile /tmp/nixos-system --set $configuration
      else if [ boot = "$action" -o switch = "$action" ]
      then ssh -C $remote nix-env --profile /nix/var/nix/profiles/system --set $configuration
           ssh -C $remote $configuration/bin/switch-to-configuration $action
      else echo "Unknown action '$action'. Use one of: dry-run, boot, switch"
      fi fi fi
    '');
  };

OK, my decision is the following:

• we deprecate ensurePermissions and leave the code alone, with a very big warning annoying message saying this option will be deleted in 24.05 if nothing is done to maintain it in a serious countenance, this buy 6 months to anyone who want to keep using this broken option, in the meantime, if anyone comes to complain about it to PGSQL maintainers who wanted to delete it will gently be told to send a fix rather than to complain. ensureDBOwnership should probably be mutually exclusive with ensurePermissions on the relevant pieces.
• we migrate everything inside nixpkgs to not use ensurePermissions and we write migration guide from ensurePermissions using initialScript but also postStart as replacements with common snippets for the classical GRANT stuff.

We need to write:

• documentation for migration
• send an announcement for unstable users
• release notes for 23.11

ASAP

1. let's please steer users away from initialScript. Maybe even deprecate as well (remember, this is only run once for the whole cluster, so huge pitfall when adding new DBs)