Operator: 'Yes, set the defaults'.

The teardown demonstrated the gap: destroy-model takes the model config with it,
so Step 3.5's apt-mirror vanished and NOTHING in the repo would have caught it --
the next deploy would have failed on package fetches and read like a mirror fault
rather than a missing model setting. That is the 'prose cannot close a stage'
class: Step 3.5 is runbook prose with no gate.

MEASURED: juju model-defaults carries apt-mirror, snap-https-proxy,
snap-store-proxy and snap-store-proxy-url, all previously unset at Controller
level. Set and read back: apt-mirror -> Controller http://10.12.8.4/ubuntu.
Defaults are inherited by NEW models only, which suits the pending add-model.

Per-DC by construction: D-104 gives each DC its own Juju controller, and these
values are per-DC, so per-controller defaults map onto per-DC values with no
cross-DC coupling.

THE SNAP KEY IS DELIBERATELY NOT SET YET -- the proxy does not exist, and
pointing snap-https-proxy at a dead address would make snap installs fail WORSE
than they do now. It lands with the proxy.

OWED: a site-keyed dc-model-defaults.sh with a check, so the values are VERIFIED
at every DC standup rather than remembered. Roosevelt shape: fold into D-136's
per-DC render pipeline. DC1 lesson: set model-defaults at controller bootstrap,
before its first add-model.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HvCyrwvYTTcDYnRErfMsNf