Security:
- Record.disconnect! cleanup thread-local DuckDB (item 3)
- Validación regex table_name/primary_key con IDENTIFIER_REGEX (item 2)
- S3 CREATE SECRET con credential_chain (item 1)
- escape_sql en aws_region del CREATE SECRET

Tests:
- 112 specs, 97.37% coverage (112 examples, 0 failures)
- Specs nuevos: Record, Engine, FileIngestor, Storage, GlueRunner, Observability

Fixes:
- Thread.current.delete → Thread.current[:key] = nil en disconnect!
- RuboCop inline disables para métricas pre-existentes

Docs:
- CHANGELOG actualizado