In the discussion we found the following compromise: The postinst should ignore the locale from the environment (as sudo and ssh make that unreliable), and instead do the following fallback:
* if /etc/default/locale defines a locale, use that
* otherwise, if /etc/environment defines a locale, use that (that's a pam_env file, so source that in a subprocess and handle errors!)
* otherwise, use C
That will break cases where the system locale is defined someplace else, but then people can still either drop and re-create the default cluster, or specify the locale on creating new DBs.