fix(auto): use action parser for repair gates

apps/api/tests/test_cs3_auto_execute.py

@@ -35,13 +35,14 @@ def _make_analysis(
 
 def _can_auto(analysis, risk_level, patterns):
     from src.models.approval import RiskLevel
+    from src.services.action_parser import is_safe_kubectl_action
     kubectl = (analysis.kubectl_command or "").strip()
     return (
         bool(kubectl)
         and analysis.confidence >= 0.85
         and risk_level != RiskLevel.CRITICAL
         and "NO_ACTION" not in (analysis.action_title or "")
-        and not any(p in kubectl.lower() for p in patterns)
+        and is_safe_kubectl_action(kubectl)
     )
 
 
@@ -78,9 +79,14 @@ class TestCS3AutoExecute:
         a = _make_analysis(action_title="NO_ACTION: no fix needed")
         assert _can_auto(a, RiskLevel.MEDIUM, patterns) is False
 
-    def test_destructive_delete_blocked(self, patterns):
+    def test_single_delete_pod_eligible(self, patterns):
         from src.models.approval import RiskLevel
         a = _make_analysis(kubectl="kubectl delete pod foo-123")
+        assert _can_auto(a, RiskLevel.MEDIUM, patterns) is True
+
+    def test_delete_pods_all_blocked(self, patterns):
+        from src.models.approval import RiskLevel
+        a = _make_analysis(kubectl="kubectl delete pods --all -n prod")
         assert _can_auto(a, RiskLevel.MEDIUM, patterns) is False
 
     def test_destructive_force_check(self, patterns):