From what I can see, the concept of an environment doesn't enter into the definition of a data mask configuration, either at the proxy or the organization level.
To confirm: A data mask doesn't need to be propagated from one environment to another. For a proxy, once a data mask is created, it immediately applies to all revisions of that proxy in all environments. Is that correct?
Yes data masks are available only at org or API level. They work across all environments in an org.