There are a number of issues with your rules. Spome of the matching patterns will never match, please read a bit more about regular expressions. And the overall logic appears reverse in parts, you want to think this through again.
Here is an alternative approach that should point you into the right direction:
RewriteEngine on
# unconditionally redirect http to https
RewriteCond %{HTTPS} !=on
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [R=301,END]
# redirect argument "username=xxx" to the "subdomain"
RewriteCond %{HTTP_HOST} ^(www\.)?example\.com$ [NC]
RewriteCond %{QUERY_STRING} (?:^|&)username=([a-z][a-z0-9-]+)(?:&|$) [NC]
RewriteRule ^ https://%1.example.com%{REQUEST_URI} [QSD,R=301]
# internally rewrite "subdomain" requests and specify the user name as argument
RewriteCond %{HTTP_HOST} ^(?:(www)\.)?([^.]+)\.example\.com$ [NC]
RewriteRule ^ %{REQUEST_URI}?username=%1 [QSA,END]
I have not tested this, just wrote it down, so let's hope there is no trivial typo in it :-)
It is a good idea to start out with a 302 temporary redirection and only change that to a 301 permanent redirection later, once you are certain everything is correctly set up. That prevents caching issues while trying things out...
In case you receive an internal server error (http status 500) using the rule above then chances are that you operate a very old version of the apache http server. You will see a definite hint to an unsupported [END] flag in your http servers error log file in that case. You can either try to upgrade or use the older [L] flag, it probably will work the same in this situation, though that depends a bit on your setup.
This implementation will work likewise in the http servers host configuration or inside a distributed configuration file (".htaccess" file). Obviously the rewriting module needs to be loaded inside the http server and enabled in the http host. In case you use a distributed configuration file you need to take care that it's interpretation is enabled at all in the host configuration and that it is located in the host's DOCUMENT_ROOT folder.
And a general remark: you should always prefer to place such rules in the http servers host configuration instead of using distributed configuration files (".htaccess"). Those distributed configuration files add complexity, are often a cause of unexpected behavior, hard to debug and they really slow down the http server. They are only provided as a last option for situations where you do not have access to the real http servers host configuration (read: really cheap service providers) or for applications insisting on writing their own rules (which is an obvious security nightmare).
