S-32d: Upsert interpolates identifiers — allow-list them

[hakeemRash]

Table/column identifiers are string-interpolated in the upsert path (developer-controlled, not user input). Fix: validate identifiers against ^[A-Za-z0-9_]+$ before use.