Draft: Remove the six labkit rack cohort feature flags

What does this MR do and why?

The three-cohort staged rollout in Default-enable the labkit rack cohort flags for... (gitlab-com/gl-infra/production-engineering#29540 - closed) has completed its soak: every cohort now unconditionally shadows and enforces in production.

This collapses ThrottleRegistry.fully_enforced? to a hardcoded true, drops the per-cohort shadow and enforce flag checks it drove, and deletes the six now-unused rate_limiter_use_labkit_rack_cohort_* flags.

Rack::Attack's legacy request-path specs are deleted rather than updated. The labkit_fully_enforced safelist in lib/gitlab/rack_attack.rb now permanently short-circuits Rack::Attack before those specs' assertions ever run, so they no longer exercise anything.

Review history

This is a re-apply of Remove the six labkit rack cohort feature flags (!253596 - merged), which merged into 19.5 by mistake and was reverted in Revert "Merge branch 'hgala/29663-remove-labkit... (!256150 - merged). The revert was purely about the milestone. Nothing was wrong with the change.

The original merge request holds the full review: 15 review threads, all resolved, approved by @ashs2, @sankalp_gl, @nindurkar and @reprazent. Read it there rather than re-reviewing from scratch.

The diff is byte-identical to the original across every changed file.

References

• Original merge request: Remove the six labkit rack cohort feature flags (!253596 - merged)
• Revert: Revert "Merge branch 'hgala/29663-remove-labkit... (!256150 - merged)
• Flag removal issue, including why removal waits for 19.6: Remove the six labkit rack cohort feature flags (gitlab-com/gl-infra/production-engineering#29663)
• Soak issue: Default-enable the labkit rack cohort flags for... (gitlab-com/gl-infra/production-engineering#29540 - closed)
• The five middleware effects the removal exposed, and what was agreed for each: LabkitRackRateLimit early user resolution: five... (gitlab-com/gl-infra/production-engineering#29728)
• Parent epic: Remove Rack::Attack from the request path (gitlab-com/gl-infra#2109)

Screenshots or screen recordings

Not applicable. There is no user interface change.

How to set up and validate locally

1. Confirm the six flag definitions are gone: ls config/feature_flags/beta/rate_limiter_use_labkit_rack_cohort_* 2>/dev/null returns nothing.
2. Confirm Gitlab::RackAttack::LabkitRateLimit::ThrottleRegistry.fully_enforced? returns true without reading a flag.
3. Confirm no references remain: grep -rn "rate_limiter_use_labkit_rack_cohort\|shadow_enabled?\|enforce_enabled?\|any_active_cohort?" lib ee/lib spec ee/spec returns nothing.
4. Run the affected specs: bundle exec rspec spec/lib/gitlab/middleware/labkit_rack_rate_limit_spec.rb spec/lib/gitlab/rack_attack/labkit_rate_limit/ spec/lib/gitlab/rack_attack_spec.rb spec/requests/labkit_rack_rate_limit_spec.rb ee/spec/requests/labkit_rack_rate_limit_spec.rb spec/requests/labkit_rack_rate_limit_fully_enforced_spec.rb spec/requests/rack_attack_headers_spec.rb

Local result on this branch: 217 examples, 0 failures. RuboCop clean on all 19 changed Ruby files.

Merge timing

Do not merge until master reaches 19.6.0-pre. Removal must land in 19.6 so self-managed gets a full milestone of soak, per Remove the six labkit rack cohort feature flags (gitlab-com/gl-infra/production-engineering#29663). This merge request stays in Draft until then.

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.