#1055 SensitiveDataFilter card pattern masks UUIDs in logs (run/app ids lost from audit logs)

EARS SPEC: - If a log message or argument contains a UUID (8-4-4-4-12 hex), then the SensitiveDataFilter shall leave it unchanged. - When a log message or argument contains a 16-digit card number written as 16 digits, or as four groups of four separated consistently by one space or one hyphen, the SensitiveDataFilter shall replace it with ****-****-****-****. - The filter shall not mask a digit run that is directly adjacent to a hex digit or a hyphen. Evidence: highway pipeline 3816 job 13898, test_app_publisher_gate_1043: record args app_id 00000000-0000-4000-8000-000000001043 became ****-****-****-****-****-****-****-****. engine/utils/secure_logging.py:39 pattern \b\d{4}[\s-]?\d{4}[\s-]?\d{4}[\s-]?\d{4}\b matches across UUID groups. api/app.py and four CLIs install the filter on the root logger and its handlers. SYNTHESIS (localised bugfix): domain = pattern-based log redaction. Concept = an anchored token match. Lookarounds exclude hex and hyphen neighbours, and a backreference requires one consistent separator. ALTERNATIVES: anchored regex [CHOSEN]; Luhn check on matches [REJECTED for now: it still matches digit-only UUID groups that pass Luhn by chance, and adds code without fixing the anchoring]; drop card masking [REJECTED: removes an existing control].