Disguise without Disruption: Utility-Preserving Face De-Identification