Hoist the auto-replay high-risk rule into OSS — it is about to be implemented twice

Problem

Auto-replay's failure-risk rule is about to exist in two downstream repos, implemented separately, both grading the same OSS type (models.FailureInfo):

repo	file	rule
k8s-proxy	pkg/utils/utils.go — IsAutoReplayHighRisk	IsHighRiskFailure(Risk) or category ∈ {SchemaAdded, SchemaBroken}
enterprise	cmd/enterprise/cli/sandbox_auto_noise_hooks.go:163	Risk == High only — the category half does not exist yet (tracked as step 4 of keploy/keploy#4601's rollout)

Both gate the same decision: may auto-replay suppress this failure as noise? Both sit immediately above an extractNoiseFromResult call that writes noise onto the testcase, so a wrong answer is persistent, not transient.

Enterprise's hook is an acknowledged mirror of k8s-proxy's (sandbox_auto_noise_hooks.go:22: "Mirrors k8s-proxy/pkg/service/replay/hooks_autoreplay.go's …"), so once the category half lands there it is the same table written twice.

Why it matters

Two copies of a risk table drift, and this drift is silent by construction: the symptom of a stale copy is a test quietly going green with auto-noise written to disk. There is no failure, no log line that says "these two repos disagree", and the mask persists into every later run. That is the exact failure mode keploy/keploy#4601 exists to close — reintroduced one layer up.

Adding a category is the likely trigger. A future SchemaRemoved or ValueTypeChanged added to k8s-proxy's list and not to enterprise's leaves the enterprise sandbox auto-replay masking it, indefinitely.

Proposal

Hoist the rule into OSS next to models.FailureInfo — e.g. models.IsAutoReplayHighRisk(info FailureInfo) bool — and have both consumers import it.

• OSS already owns FailureInfo, RiskLevel and FailureCategory, so the rule has no dependency that keeps it downstream.
• k8s-proxy's pkg/utils.IsAutoReplayHighRisk becomes a one-line delegate (or is deleted at its call site, hooks_autoreplay.go:1319).
• enterprise's gate at sandbox_auto_noise_hooks.go:163 calls the same function instead of growing its own copy.
• pkg/utils.IsHighRiskFailure stays where it is — it is the general replay rule, not the auto-replay one, and the two are deliberately different.

Sequencing

Not urgent, and explicitly not a blocker for keploy/keploy#4601 or keploy/k8s-proxy#960. The cheapest ordering is to land enterprise's category half first (it is already on the critical path for the Test.AutoReplay rollout), then collapse both copies into the OSS definition in one follow-up, so the hoist is a pure de-duplication with no behaviour change to review.

Raised from the review discussion on keploy/keploy#4601.