Best case, average case and worst case give three different answers for the same algorithm. Which one should a system be designed around, and why?

B. It depends on the consequence of being slow.

The right case depends on what a slow operation costs: a web server absorbs an occasional slow request, and a real-time system that misses a deadline has missed it. Which is why quicksort is a fine default and a poor real-time choice. The worst case is also an attack surface, hash flooding triggers it deliberately, and 'it never happens in practice' holds only while nobody is trying.