Replication mode at the template-default level — “what does
the workload’s recovery model look like, before consumer
overrides?”. Distinct from durable_workload::ReplicationMode
(which carries runtime data like the standby provider list) and
cli::commands::deploy::ReplicationMode (the CLI flag enum).
This one is a const-friendly tag for template tables.
Default policy for --encrypt-volume on the spawn CLI: should
the consumer’s data volume be LUKS-encrypted at rest unless
they explicitly pass --no-encrypt-volume?