fix(auto): use action parser for repair gates

apps/api/tests/test_rule_engine_auto_execute.py

@@ -19,6 +19,7 @@ CS2 規則引擎自動執行條件邏輯測試
 """
 
 from src.models.approval import RiskLevel
+from src.services.action_parser import is_safe_kubectl_action
 from src.services.auto_approve import _DESTRUCTIVE_PATTERNS
 
 
@@ -31,11 +32,10 @@ def _evaluate_can_auto(
     複製 webhooks.py CS2 路徑的 _can_auto 邏輯，用於單元測試。
     任何修改 webhooks.py 邏輯的人，必須同步更新此函數。
     """
-    _destructive_set = set(p.lower() for p in _DESTRUCTIVE_PATTERNS)
     return (
         bool(rule_kubectl)
         and rule_risk != RiskLevel.CRITICAL
-        and not any(p in rule_kubectl.lower() for p in _destructive_set)
+        and is_safe_kubectl_action(rule_kubectl)
         and "NO_ACTION" not in rule_action
     )
 
@@ -90,12 +90,12 @@ class TestCS2CanAutoConditions:
 
     # ── 防線 3：DESTRUCTIVE_PATTERNS ────────────────────────────────────
 
-    def test_delete_pod_returns_false(self):
+    def test_single_delete_pod_returns_true(self):
         assert _evaluate_can_auto(
             rule_kubectl="kubectl delete pod api-xxx-yyy -n prod",
             rule_risk=RiskLevel.LOW,
             rule_action="刪除 Pod | kubectl delete pod api-xxx-yyy -n prod",
-        ) is False
+        ) is True
 
     def test_delete_pods_returns_false(self):
         assert _evaluate_can_auto(
@@ -104,6 +104,13 @@ class TestCS2CanAutoConditions:
             rule_action="刪除所有 Pod | kubectl delete pods --all -n prod",
         ) is False
 
+    def test_delete_pod_force_returns_false(self):
+        assert _evaluate_can_auto(
+            rule_kubectl="kubectl delete pod api-xxx-yyy --force -n prod",
+            rule_risk=RiskLevel.LOW,
+            rule_action="強制刪除 Pod | kubectl delete pod api-xxx-yyy --force -n prod",
+        ) is False
+
     def test_scale_to_zero_returns_false(self):
         assert _evaluate_can_auto(
             rule_kubectl="kubectl scale deployment/api --replicas=0 -n prod",