Mask a Lakebase map field as a whole, not per entry

[denik]

Stacked on #6440 — review that one first.

A bundle that changes one key of postgres_endpoints.settings.pg_settings cannot deploy:

Unknown field path in update_mask: 'spec.settings.pg_settings['statement_timeout']'

The plan diffs maps entry by entry, so the change path carries the map key and the mask repeated it verbatim. A map or repeated field is addressable only as a whole. Probed against a real endpoint on 2026-08-31: spec.settings and spec.settings.pg_settings are both accepted, the indexed form is not.

So drop everything from the first subscript on, and dedupe — two changed entries of one map collapse onto the same path. Terraform is unaffected; it masks the whole spec.

Two tests, both local and cloud:

• update_pg_settings — edit a key. Fails without this change.
• add_settings — add the whole block, which leaves one change path and masks the message itself. That path was missing from the fake's allowed list, so a case the real API accepts was failing locally.

This pull request and its description were written by Isaac.

[github-actions]

Approval status: pending

/acceptance/bundle/ - needs approval

14 files changed
Suggested: @pietern
Also eligible: @janniklasrose, @andrewnester, @shreyas-goenka, @anton-107, @lennartkats-db

/bundle/ - needs approval

Files: bundle/direct/dresources/util.go
Suggested: @pietern
Also eligible: @janniklasrose, @andrewnester, @shreyas-goenka, @anton-107, @lennartkats-db

General files (require maintainer)

Files: .nextchanges/bundles/postgres-map-update-mask.md, libs/testserver/postgres.go
Based on git history:

• @pietern -- recent work in libs/testserver/, bundle/direct/dresources/

_{Any maintainer (@andrewnester, @anton-107, @pietern, @shreyas-goenka, @simonfaltum, @renaudhartert-db, @janniklasrose, @lennartkats-db, @rugpanov, @rclarey) can approve all areas.
See OWNERS for ownership rules.}