fix(gateway): suppress bandit B608 false positive in update_write_status

schema/table are allowlist-validated via _validate_identifier() before
interpolation (see docstring above), not a real SQL injection vector.
The existing '# noqa: S608' only silences ruff; bandit runs as its own
CI step and needs its own '# nosec B608' suppression syntax.

ingestor/io/data_sink.py

@@ -54,7 +54,7 @@ class DataSink:
         # schema/table are allowlist-validated identifiers above; status/timestamp/model_id
         # are bound params below, never interpolated — not a real injection vector.
         stmt = text(
-            f'UPDATE {schema}.{table} SET write_status = :status '  # noqa: S608
+            f'UPDATE {schema}.{table} SET write_status = :status '  # noqa: S608 # nosec B608
             'WHERE timestamp = :timestamp AND model_id = :model_id'
         )
         params = {