“Choose a username that is …and must contain”: phrased incorrectly or just awkwardly?

Solution 1:

I would say your objection is entirely correct.

The imperative can loosely be rephrased as a ‘must’ clause, which would yield:

You must choose a password that must contain…

This is awkward to the point of being ungrammatical to me. There is only one real requirement, not two separate and separable ones. In some contexts, the ‘double mustness’ can work and make sense, but this is not one.

An example where it does work could be:

Give three reasons that tax laws must be enforced.

In this case, the two requirements (1. Giving three reasons; and 2. Tax laws must be enforced) are separable and do not coincide, so they can be ‘musted’ separately.

In your example, on the other hand, one requirement hinges on the other, and they cannot be separated into two unrelated and inherently sufficient requirements.