IMO, it is, but experts may know better.
- Is cloning templates considered good practice, or is it generally worse than building new templates from scratch?
It is easier to clone a template before experimenting with it rather than mess it up and reinstall it.
- Is my plan, cloning each template for every new app I install, reasonable if I have a sufficiently strong PC? Conceptually, I’d run multiple Debian, Fedora, and Whonix workstations, each dedicated to a specific purpose, so that if an app is malicious or compromised, it only affects that particular cloned template.
For every single new app - unlikely. It would be an overkill and usability nightmare to e.g. have separate template for less and xterm.
You may be interested to read:
- Is using multiple Whonix gateways a good idea from a privacy standpoint, assuming I maintain separate identities and want them isolated?
As long as the gateway is not compromised, using only one gateway and one identity at a time would be best, IMO. Next identity can use the same gateway, ideally leaving some time interval between the the two identities to prevent correlation.
- How can I change default application settings (e.g., Firefox preferences, Tor Browser security level) so disposable qubes inherit those settings while non-disposable qubes also keep the correct defaults? Should this be configured in the appVM or the templateVM?
Setting the “correct defaults” in template would give you the same defaults for your AppVMs based on that template.
Setting custom defaults a disposable template (AppVM) would propagate to disposables based it.
Also, when I try to start Tor Browser inside the Whonix workstation template, I get a warning and it won’t launch. What’s the right place for making that work?
Don’t run any software in templates to keep them clean. Run it in AppVMs and disposables.