MosFET avalanche is NOT specified nor intended for inductive leakage energy dissipation.
The energy to dissipate per cycle is proportional to the leakage L and current peak, squared.
No snubbers>>blown MOSFETs
Not unequivocally. But I would certainly never suggest to rely on it.
In this case, it's probably a bad idea:
https://datasheetspdf.com/pdf-file/580997/CET/CEP50N06/1Datasheet gives single avalanche rating, but not repetitive. Now, maybe they just didn't care to test it for reps, but also possible is it accumulates damage.
It's most likely a common mid-generations trench type; the avalanche failure mechanism in these, AFAIK, is the "hot" electrons skating along the narrow web that is the channel in avalanche; inevitably some shoot out sideways, lodging in the gate oxide, inducing trapping defects, and eventual failure. This is measurable by a shift in Vgs(th), though it's apparently quite a subtle change despite what it sounds like, and you don't know how far it can move before destruction occurs.
Contrast with HEXFETs and such (older generations), where the gate oxide is on the top surface and the channel lies in a depletion region beneath; avalanche occurs under the source contacts/diffusions, beside the channel, which is more or less dead wasted space in conduction, hence the low area performance of HEXFETs, but also the reason for their famous avalanche robustness -- including repetitive, usually!
Compare IRFZ46N for example, a similar sized HEXFET:
https://www.infineon.com/dgdl/irfz46npbf.pdf?fileId=5546d462533600a40153563b734b2220
OP: what you're missing is two things:
1. Your equivalent diagrams omit the RC, for some reason, showing diodes shorting out the winding, which obviously isn't the case. I suppose one could draw such an equivalent for maybe the first half-cycle, before the capacitor is charged to peak voltage, but at such low frequencies, and no current limiting to speak of, it'll charge very quickly indeed. Just for purposes of illustrating the current flow directions, and switching phases, yes, that will be correct, but the magnitude of diode currents will be wildly unrealistic (and transformer voltages for that matter).
2. No transformer is perfect. The key here is leakage inductance, which manifests as a lone, uncoupled (because it's leaking out from between the windings!) inductance in series with each terminal. Since it doesn't couple, it doesn't contribute to transformer action, it doesn't contribute to magnetizing current/inductance, it bears no relation to the intended current flows, and acts as parasitic waste in the circuit -- it must be charged to peak output current every cycle, then discharged at turn-off. We can therefore model it as a flyback circuit, and a simple RCD clamp snubber will do the job.
Length of the snubber trace does look quite ponderous, and a capacitor installed near the diodes would be preferable (the adjacent node is GND I believe, which is an AC supernode where the capacitor can also connect), but keep in mind the transistor turn-off isn't exactly rapid, the gate drive is quite weak here. This is reflected in the relatively long (>500ns) turn-off, which likely gives plenty of time for current to shift into that longer path. The resulting equivalent circuit will be some stray inductance in series with the diodes' common cathode path, maybe 30-50nH, and therefore the two inductances (the leakage/flyback and snubber stray) act in series as an impedance divider, leaving some peak voltage at the MOSFETs, but I'm assuming leakage is dominant here (100s nH? ~uH?) so the peak will be small.
BTW, 1x probes are useless for switching circuits, the bandwidth is about 7MHz typically; check your probe datasheet. Please use 10x, and check compensation against the scope cal point to ensure a nice flat square wave before taking measurements. BW limit can then be raised from 20MHz as well. It's likely that actual avalanche was in fact going on here, and just not measured due to the lack of bandwidth. Which means you've unwittingly/unknowingly put wear on the transistors, and risked their destruction in the process.
Anyway, a film capacitor is indeed ideal here. I'm not sure where you'd find a "470nF 1kV ceramic", but I'm assuming that's just a typo, and some ~uF MLCC will be fine as well, but do beware C reduction under bias.
The minimum value can be calculated from LL, peak turn-off current, and desired peak voltage change, since the flyback circuit forms a resonant tank with the inductor and capacitor (it goes through < 1/4 of a wave, due to initial voltage plus the diode terminating the ringing wave partway through, but it is in fact going through a section of an LC ringdown waveform in the process). Taking ballpark figures of 1uH, 50A and 10V, sqrt(L/C) = (10V/50A) needs C > 25uF. I would suggest replacing the original with a low-ESR electrolytic, or polymer even if you like, and placing the MLCC by the diodes. This addresses both the stray inductance, some of the electrolytic's ESR (but not much considering the large expected value of C), and the apparently dry (or not-well-performing anyway) original capacitor.
...Oh, hah, 1N4007 huh? Those will dissipate quite some power in recovery as well, which likely didn't help the electrolytic in there. I would rather a medium-fast recovery type like FR102. Or even a 3A diode, if it'll fit.
Tim