Automated Data Masking during Staging Database Migrations

Act as a Data Privacy Engineer. In the context of rigorously testing database migrations, detail a highly automated architectural process for continuously refreshing a lower-tier staging [DATABASE_ENGINE] environment utilizing a clone of live production data. The absolute mandate is to cryptographically obfuscate and redact highly [SENSITIVE_COLUMNS] (e.g., SSNs, plaintext emails, financial hashes) on-the-fly utilizing a dedicated [MASKING_TOOL] (e.g., PostgreSQL `pgcrypto`/`anon` extension, or AWS Macie). This masking execution must be seamlessly embedded into the CI/CD nightly migration testing loop. Ensure the algorithmic masking logic perfectly preserves the statistical data distribution, string lengths, and complex foreign-key referential integrity, mathematically guaranteeing that the migration scripts are battle-tested against realistic 'shapes' and volumes of data without ever exposing actual PII to the developer teams.