Resolve plain-text masks with the same override shape as path exclusions: explicit CLI/builder values beat YAML, and both empty falls back to the upstream defaults.