simplify: remove disk re-reads, fix dead param, return set from load_combined

[jordankrueger]

Summary

• build.py — allowlist self-test now checks in-memory domain sets instead of re-reading all four output files from disk. Same safety guarantee, avoids 4× 66k-domain parse round-trip that was redundant (we already have those sets in memory right after writing them).
• import_to_actionkit.py — removed dead base_url parameter from fetch_existing() (it was never referenced inside the function; the URL was always built from instance directly). Inlined the base URL at the one POST call site.
• import_to_actionkit.py — load_combined() now returns set[str] directly, eliminating the redundant set(domains) wrap in main().
• import_to_actionkit.py — converted stray .format() call to f-string for consistency with the rest of the file.

Test plan

• Smoke test passed: normalize() works, load_combined() returns a set of 66,169 domains with gmail.com absent
• Full python3 scripts/build.py --no-fetch run (CI / manual)
• AI code review (auto-triggered)

🤖 Generated with Claude Code

[github-actions]

AI Code Review (gpt-5.1-codex-mini)

🟡 IMPORTANT scripts/import_to_actionkit.py:74 — fetch_existing now drops the base_url parameter while the body still uses base_url to build GET calls; the name is undefined and the import script will raise a NameError before making any requests, so existing domains can’t be read or compared.

---

Summary: Removing base_url from fetch_existing broke the function: it now references an undefined name and will crash before syncing with ActionKit, so the import script cannot run.
Result: FAIL — blocking findings detected

1 finding(s) at or above 'important' threshold block this PR.