schema/table are allowlist-validated via _validate_identifier() before interpolation (see docstring above), not a real SQL injection vector. The existing '# noqa: S608' only silences ruff; bandit runs as its own CI step and needs its own '# nosec B608' suppression syntax.