Speed up corpus scanning by about 25%

[danslo]

Summary

• coalesce overlapping regex verification windows when a merged negative result can safely reject all candidates
• fast-path sparse Aho-Corasick states with zero or one outgoing edge
• convert highly branched trie states to dense transition rows
• tag matching transition targets to avoid a separate match-bitset lookup for every scanned byte

Performance

Using:

go run ./cmd/corpus-bench \
  -yara ~/Code/ecomscan-signatures/build/ecomscan.yar \
  -corpus ~/Code/ecomscan-signatures/corpus

Metric	Before	After
Yargo scan	~11.5s	~8.65s
Full command wall time	13.2s	10.2s
Matches	26,246	26,246
Max RSS	1,056,512 KiB	1,068,688 KiB

This is approximately a 25% scan-time reduction with about 12 MiB additional peak RSS.

Regex instrumentation showed FindIndex calls dropping from 1,701,391 to 438,793 and bytes passed to regex verification dropping from 1.71 GB to 671 MB.

Verification

• go test ./...
• compared a digest of every matched rule and matched string payload across all 5,695 corpus files; before and after both produced:
  0c735cd65d79e086a981dae70362e8e58da46d0b7576a5437613a8276385cc75