fix(masking): mask at handler level instead of repointing streams

[kyungsoo-datahub]

Problem

In datahub-executor (celery worker mode), enabling secret masking silenced all logs from the worker process. After an ingestion with secrets, celery/root logs stopped appearing — the ingestion subprocess kept logging, which was misleading.

Root causes

1. install_masking_filter() repointed the stdout/stderr handler streams at the wrapped sys.stderr (via _update_existing_handlers). Under celery, sys.stderr is a proxy that re-enters logging, so the handler looped until a RecursionError that the wrapper silently swallowed — every line dropped. Teardown restored sys.stderr but not the handlers, so it stayed broken.
2. The filter sat on the root logger, which Python doesn't consult for records propagated from child loggers — so child-logger output (nearly all logs) was only ever masked via that stream-repointing.

Fix

• Mask at the handler level: attach the filter to existing handlers (records masked in place, streams untouched).
• Remove _update_existing_handlers() — no stream repointing, so no celery recursion.
• Keep the sys.stdout/sys.stderr wrapper only for raw print() output.
• Symmetric teardown: remove the filter from handlers on uninstall.
• Skip datahub.masking.* loggers (they bypass masking by design).
• Repeat install re-scans for handlers added since; logger/handler iteration is concurrency-safe.

[codecov]

Codecov Report

❌ Patch coverage is 89.28571% with 3 lines in your changes missing coverage. Please review.
✅ All tests successful. No failed tests found.

Files with missing lines	Patch %	Lines
...ta-ingestion/src/datahub/masking/masking_filter.py	89.28%	3 Missing ⚠️

📢 Thoughts on this report? Let us know!