fix(secops): avoid stdout logging in investigations

[nightcityblade]

Fixes #267

Summary

• route list_investigations diagnostics through the module logger instead of stdout
• add a regression test that keeps the MCP stdio channel free of diagnostic output

Testing

• python -m pytest -q server/secops/tests/test_investigation_management_unit.py (1 passed)
• ruff check --isolated --select E9,F63,F7,F82 on changed files
• python -m compileall -q on changed files

[google-cla]

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.

[dandye]

Thank you for opening this PR to address stdout printing in investigation management.

We are closing this PR due to the following considerations:

1. Google CLA Requirement: The Google Contributor License Agreement check (cla/google) has not been completed for this PR.

2. Test Coverage and Structure: The added unit test asserts capsys.readouterr().out == "" on the happy path, but does not exercise the exception handling path (where print(error_msg) was replaced with logger.exception(error_msg)). Additionally, checking for empty stdout does not verify that the logger was actually invoked with the appropriate severity level and message formatting. In this repository, we prefer standard caplog or unittest.mock.patch fixtures over ad-hoc stub classes and monkeypatch.

We will incorporate logger routing across investigation_management.py with full unit test coverage into our upcoming maintenance release. Thank you for bringing attention to this issue.