docs(templates): the opt-in snippet promised a fail-closed index it never got

PRIVATE_INDEX.md told agent authors to put `default = true` on the mirror in
their pyproject. That was wrong in two ways at once, and Greptile flagged the
consequence on the Dockerfile side.

It never took effect. The Dockerfiles export `UV_INDEX`, which binds the mirror
as a NAMED index ahead of public PyPI rather than replacing it as the default,
and a name rebound that way does not carry the project entry's default flag.
Measured: with a mirror that 404s a package, `UV_INDEX` resolves it from public
PyPI while `UV_DEFAULT_INDEX` fails the build.

And it is not what we want anyway. The mirror is there to supply the
Scale-internal packages that are not on public PyPI — sgp-obs, scale-memory —
not to become the sole source for every dependency of every scaffolded agent.
Making it the default would give ~147 agent repos a hard dependency on the
mirror being healthy and complete for builds that have nothing to do with
observability.

So the snippet drops the flag and the doc now states the real resolution order:
mirror first, public PyPI as fallback. sgp-obs can only come from the mirror
because it exists nowhere else; an ordinary dependency the mirror lacks still
resolves. The note explains why the flag is absent so it does not get helpfully
re-added.

No code change — the templates already behave this way.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Author: stephen-wang24

src/agentex/lib/cli/templates/PRIVATE_INDEX.md

@@ -22,9 +22,21 @@ Add the index to the agent's `pyproject.toml`:
 [[tool.uv.index]]
 name = "scale-pypi"
 url = "<the scale-customer-pypi URL>"
-default = true
 ```
 
+**No `default = true`, deliberately.** An earlier revision of this snippet had it, which was
+misleading in both directions. It would not survive the build — the Dockerfiles export
+`UV_INDEX`, which binds the mirror as a *named* index ahead of public PyPI rather than
+replacing it as the default, and a name rebound that way does not carry the project entry's
+default flag. And it is not the behaviour we want anyway: the mirror exists to supply the
+Scale-internal packages that are not on public PyPI, not to become the sole source for every
+dependency.
+
+So resolution is **mirror first, public PyPI as fallback**. `sgp-obs` can only come from the
+mirror, because it exists nowhere else. An ordinary dependency the mirror happens not to carry
+still resolves from PyPI instead of failing the build, which is what keeps a scaffolded agent
+building when the mirror is incomplete or unreachable.
+
 The name must be exactly `scale-pypi`. uv applies `UV_INDEX_SCALE_PYPI_USERNAME` /
 `UV_INDEX_SCALE_PYPI_PASSWORD` to the index of that name, so renaming it makes the credentials
 silently stop applying. Setting `UV_INDEX_URL` instead does not authenticate a *named* index at