I say this only to emphasize that there are always things that are critical
> that are elided in a testcase that tries to be minimal.
>
> So it seems that there's something critical about my env that I'm failing
> to tell you all. But what can it be?
>
>
Removing permissions also works for me. In my case, I created a brand new
PG14.5 cluster in docker and ran Tom's test case.
Your test code seems quite complex to test this simple case, but looking
through it, it appears that you revoked permissions to pg_terminate_backend
in the postgres database, but then connected as r1 to the play database,
where the permissions weren't revoked. You'll have to revoke the
permissions in all databases or change it in template1 before creating the
new database.