The phrase matcher emits output in several pieces (plaintext flushed
ahead of a candidate prefix, single bytes replayed after a failed match,
mask callbacks). Passing each straight through split one caller Write
into many downstream writes, which a \r-flushing timestamper turned into
separate, mis-stamped entries — e.g. fragmenting a progress meter's
"\rUploading cache ..." frame into "Uploading cach" / "e ...".

Buffer a single top-level Write's output and flush it once, preserving
the caller's write boundary. The bytes and masking decisions are
unchanged.

Token prefixes were masked whole (glpat-XXX -> [MASKED]). Mask only the
token body and keep the prefix, matching GitLab Runner's masker
(glpat-XXX -> glpat-[MASKED]). Reuse the callback already used for URL
parameter masking, which keeps the matched key in place.

coalesce buffers a Write's output and flushes it to the underlying
writer in one call. write() targets the in-memory buffer and can't
fail, so on a flush error Write now returns 0 rather than len(p),
signalling a short write per the io.Writer contract instead of
claiming every byte reached the writer.

Fix log masking: preserve atomic writes and keep token prefixes visible

See merge request !545