Masker fragments a caller's Write, breaking \r-flushed trace entries

Problem

The phrase matcher in streamer/sanitizer + phrasestream emits its output in several pieces:

• plaintext flushed ahead of a candidate phrase prefix
• single bytes replayed after a failed match
• mask callbacks

Each piece was written straight through, so a single Write from a producer became several downstream writes.

Downstream, the \r-flushing timestamper starts a new trace entry for any write containing a carriage return. The transfer meter emits each progress update as one atomic, \r-led write ("\rUploading cache <n>/<total> (<rate>)…"). When the job has a masked secret, the matcher split that frame at an interior byte, so the timestamper emitted it across two entries with two timestamps, visibly breaking the word:

… 01O+\rUploading cach
… 01O+e 0 B/7.30 GB (0 B/s)                \rUploading cach

This only reproduces when the job has masked variables, which is why it slipped through.

Expected behavior

The masker should buffer a single top-level Write's output and flush it once, preserving the caller's write boundary. The bytes emitted and the masking decisions should be unchanged, only the batching.