All constructors (LoadFile, LoadFiles, ReadAll) now return &Cohort{}
on error instead of nil. Callers can use the result directly without
nil checks — an empty Cohort is a valid empty set that returns false
for all Contains calls.
IPv4 host + CIDR membership testing backed by sorted /32 binary search
and a linear scan of CIDR ranges. CSV/text loader with bounded reads
(maxBytes is required so callers pick a limit appropriate to their
input source — 1 KB allowlists through 100+ MB threat feeds). Returns
errors for unparseable IPs so callers can decide fail-open vs
fail-closed; partial cohorts are returned alongside parse errors.
