Please address the comments from this code review:

## Overall Comments
- The `log.Infof` calls inside the profile loops in `convertCentralRequestToScanSettingBinding` and `updateScanSettingBindingFromCentralRequest` will emit a log per profile on every apply/update, which may be noisy in large clusters; consider reducing to debug level or aggregating into a single log statement.
- The logic that builds `profileRefs` for scan setting bindings is duplicated between `convertCentralRequestToScanSettingBinding` and `updateScanSettingBindingFromCentralRequest`; consider extracting a shared helper to keep the legacy/new-path behavior consistent and easier to maintain.
- In `profileKindToString`, all unknown or future `ComplianceOperatorProfileKind` values silently fall back to `Profile.Kind`; consider handling unexpected enum values explicitly (e.g., via a `switch` with a default log or error) to make misconfigurations easier to detect.

## Individual Comments

### Comment 1
<location path="sensor/kubernetes/complianceoperator/utils.go" line_range="84-86" />
<code_context>
-		})
+	if refs := request.GetProfileRefs(); len(refs) > 0 {
+		// New Central: kind is provided directly — no k8s API call needed.
+		for _, ref := range refs {
+			kind := profileKindToString(ref.GetKind())
+			log.Infof("Profile %q in namespace %q: kind %q provided by Central", ref.GetName(), namespace, kind)
+			profileRefs = append(profileRefs, v1alpha1.NamedObjectReference{
+				Name:     ref.GetName(),
</code_context>
<issue_to_address>
**suggestion (performance):** Profile-level Info logging may be noisy at scale

For larger clusters, logging at Info for every profile on each scan could overwhelm logs. If this is mainly for debugging or initial verification, consider using Debug level, a verbosity flag, or some rate limiting to reduce log noise.

```suggestion
			kind := profileKindToString(ref.GetKind())
			log.Debugf("Profile %q in namespace %q: kind %q provided by Central", ref.GetName(), namespace, kind)
			profileRefs = append(profileRefs, v1alpha1.NamedObjectReference{
```
</issue_to_address>

### Comment 2
<location path="central/complianceoperator/v2/compliancemanager/manager_impl.go" line_range="290-292" />
<code_context>

+	// Build profile refs from the already-fetched profiles so Sensor can use the correct CO kind
+	// (Profile vs TailoredProfile) without needing to probe the k8s API.
+	profileRefs := make([]*central.ApplyComplianceScanConfigRequest_ProfileReference, 0, len(returnedProfiles))
+	for _, p := range returnedProfiles {
+		profileRefs = append(profileRefs, &central.ApplyComplianceScanConfigRequest_ProfileReference{
+			Name: p.GetName(),
+			Kind: central.ComplianceOperatorProfileV2_ComplianceOperatorProfileKind(p.GetComplianceOperatorKind()),
</code_context>
<issue_to_address>
**suggestion (bug_risk):** Relying on a cast between two enums can be brittle if they diverge

This line relies on `central.ComplianceOperatorProfileV2_ComplianceOperatorProfileKind(p.GetComplianceOperatorKind())` preserving matching numeric values between the datastore and proto enums. If either enum changes independently, the wrong kind could be sent. Prefer an explicit mapping (e.g., a small switch) to make the dependency and failure modes explicit.

Suggested implementation:

```golang
	// Build profile refs from the already-fetched profiles so Sensor can use the correct CO kind
	// (Profile vs TailoredProfile) without needing to probe the k8s API.
	profileRefs := make([]*central.ApplyComplianceScanConfigRequest_ProfileReference, 0, len(returnedProfiles))
	for _, p := range returnedProfiles {
		var kind central.ComplianceOperatorProfileV2_ComplianceOperatorProfileKind

		switch p.GetComplianceOperatorKind() {
		case storage.ComplianceOperatorProfileV2_PROFILE:
			kind = central.ComplianceOperatorProfileV2_PROFILE
		case storage.ComplianceOperatorProfileV2_TAILORED_PROFILE:
			kind = central.ComplianceOperatorProfileV2_TAILORED_PROFILE
		default:
			// Make dependency and failure mode explicit if enums diverge or an unexpected
			// value is stored. Log and skip this profile rather than sending an incorrect kind.
			log.Errorf("Unknown compliance operator profile kind %v for profile %q; skipping profile in scan configuration %q",
				p.GetComplianceOperatorKind(), p.GetName(), scanRequest.GetScanConfigName())
			continue
		}

		profileRefs = append(profileRefs, &central.ApplyComplianceScanConfigRequest_ProfileReference{
			Name: p.GetName(),
			Kind: kind,
		})
	}

```

1. This change assumes that:
   - The datastore enum type used by `p.GetComplianceOperatorKind()` is `storage.ComplianceOperatorProfileV2_ComplianceOperatorProfileKind`.
   - The datastore enum values are `storage.ComplianceOperatorProfileV2_PROFILE` and `storage.ComplianceOperatorProfileV2_TAILORED_PROFILE`.
   - The central proto enum values are `central.ComplianceOperatorProfileV2_PROFILE` and `central.ComplianceOperatorProfileV2_TAILORED_PROFILE`.
   If the actual enum names differ, adjust the `switch` cases and assigned central constants accordingly.
2. Ensure that the `storage` package is imported in this file (it typically is in this codebase). If it is not, add:
   `storage "github.com/stackrox/rox/generated/storage"`
   to the imports block.
</issue_to_address>

### Comment 3
<location path="sensor/kubernetes/complianceoperator/utils.go" line_range="79" />
<code_context>

 func convertCentralRequestToScanSettingBinding(namespace string, request *central.ApplyComplianceScanConfigRequest_BaseScanSettings, _ string) runtime.Object {
 	profileRefs := make([]v1alpha1.NamedObjectReference, 0, len(request.GetProfiles()))
-	for _, profile := range request.GetProfiles() {
</code_context>
<issue_to_address>
**issue (complexity):** Consider extracting the duplicated profile reference branching and construction logic into a shared helper function used by both callers to simplify and unify the code.

You can reduce the added complexity by extracting the duplicated branching + construction into a small helper that both call sites use.

For example:

```go
func buildProfileRefs(
    request *central.ApplyComplianceScanConfigRequest_BaseScanSettings,
    namespace string,
    action string, // e.g. "create" or "update"
) []v1alpha1.NamedObjectReference {
    refs := make([]v1alpha1.NamedObjectReference, 0, len(request.GetProfiles()))

    if profileRefs := request.GetProfileRefs(); len(profileRefs) > 0 {
        // New Central: kind is provided directly — no k8s API call needed.
        for _, ref := range profileRefs {
            kind := profileKindToString(ref.GetKind())
            log.Infof("Profile %q in namespace %q: kind %q provided by Central (%s)", ref.GetName(), namespace, kind, action)
            refs = append(refs, v1alpha1.NamedObjectReference{
                Name:     ref.GetName(),
                Kind:     kind,
                APIGroup: complianceoperator.GetGroupVersion().String(),
            })
        }
        return refs
    }

    // Legacy: old Central without profile_refs — default to Profile kind.
    for _, profile := range request.GetProfiles() {
        refs = append(refs, v1alpha1.NamedObjectReference{
            Name:     profile,
            Kind:     complianceoperator.Profile.Kind,
            APIGroup: complianceoperator.GetGroupVersion().String(),
        })
    }

    return refs
}
```

Then both callers become simpler and consistent:

```go
func convertCentralRequestToScanSettingBinding(namespace string, request *central.ApplyComplianceScanConfigRequest_BaseScanSettings, _ string) runtime.Object {
    profileRefs := buildProfileRefs(request, namespace, "create")

    return &v1alpha1.ScanSettingBinding{
        TypeMeta: v1.TypeMeta{
            Kind:       complianceoperator.ScanSettingBinding.Kind,
            APIVersion: complianceoperator.GetGroupVersion().String(),
        },
        ObjectMeta: v1.ObjectMeta{
            Name:        request.GetScanName(),
            Namespace:   namespace,
            Labels:      stackroxLabels,
            Annotations: map[string]string{},
        },
        Profiles: profileRefs,
        ScanSettingsName: request.GetScanSettingsName(),
    }
}
```

```go
func updateScanSettingBindingFromCentralRequest(scanSettingBinding *v1alpha1.ScanSettingBinding, request *central.ApplyComplianceScanConfigRequest_BaseScanSettings) *v1alpha1.ScanSettingBinding {
    ns := scanSettingBinding.GetNamespace()
    scanSettingBinding.Profiles = buildProfileRefs(request, ns, "update")
    // TODO:  Update additional fields as ACS capability expands
    return scanSettingBinding
}
```

This keeps all current behavior, logging, and backward compatibility, while centralizing the branching and `NamedObjectReference` construction in one place.
</issue_to_address>