fix: address round 2 code review findings

- Add 1 GiB extraction size limit to Untar and short-circuit IsSkippable
- Return fs.SkipDir for directories matching skiplist in walkFiles
- Return empty slice from FormatMatches and exclude Err from default JSON
- Convert LoadConfig method to NewConfig constructor function
- Add missing error assertions in table-driven tests
- Refactor main.go to use run() pattern for proper defer cleanup
- Use TrimSuffix for namespace derivation instead of ReplaceAll
- Only include scan results that have matches

Co-Authored-By: Claude Opus 4.6 <[email protected]>

ci: bump YARA-X version to 1.13.0 to match Go bindings

The Go module requires yara-x/go v1.13.0 but CI was building the
C library from v0.12.0, causing missing symbol errors (YRX_BOOLEAN,
YRX_BYTES, etc).

Co-Authored-By: Claude Opus 4.6 <[email protected]>

v2.0.0: YARA-X migration and Go modernisation

Putting things together

I really don't enjoy erasing history, but this particular project
has a good number of commits that I'm not particularly proud of,
and also referenced some things that on reflection, aren't
suitable for a public forum.