Make the two build scripts importable, and read the real prefix lists - #108

`build_subsets.py` resolved every Mech checkout at import — `MECHS` called
`mech_root`, which exits when one is missing — and then scanned. `build_data.py`
read both JSON inputs at import and rewrote fleet_data.json. Neither could be
imported to look at a constant (#97).

Both now keep only the pure constants at module level. `build_subsets` grew a
`prepare()` that resolves the checkouts and indexes HabitatMech's pages, and
everything from the scan onward moved into `main()`; the function bodies are
untouched and still refer to the same module-level names, so `MECHS`,
`hab_pages` and the rest are declared empty and filled by `prepare()` rather
than moved. `build_data` grew `build()` and `main()`, with the same treatment.
Importing either is now free and writes nothing.

That lets the tests read the lists the pipeline actually uses. They had been
recovered from the source text with `ast`, which cannot see a list rebuilt
after its literal — the hole #99 closed partly and #101 recorded the rest of.
Reading the objects retires the class: all five shapes now fail, including the
three the parser could not see.

    VOC, _X = [...], 1     parser: passed   import: FAILED
    del VOC[0]             parser: passed   import: FAILED
    VOC[0] += "X"          parser: passed   import: FAILED
    VOC += [...]           parser: FAILED   import: FAILED
    VOC.append(...)        parser: FAILED   import: FAILED

`literal()` and its mutator allowlist are gone with the parsing they served.

Verified behaviour-preserving by running both scripts before and after the
refactor over the same checkouts and comparing every output file. `assets/fleet`
and `subsets_summary.json` match semantically: identical per-Mech scan counts,
identical edge weights and `by` breakdowns, identical term lists in identical
order, every term entry equal.

One edge file differs by bytes, and it is not this refactor. `CAS` and `ENVO`
are tied at 1 in that edge's `by`, and `Counter.most_common()` breaks ties by
insertion order, which comes from iterating a set of strings under per-process
hash randomization. Filed as #107, since it means a refresh churns committed
assets for no reason and the pipeline cannot be used to verify itself.

No committed data changes here; the runs' output was restored.

Rebased over #105, carrying its CITATION filter into main(). From the review:
main() now calls prepare() itself, so importing the module and calling main()
resolves the checkouts instead of failing with a KeyError inside scan()
(closes #117); the unused `import ast` left behind by literal()'s removal is
gone (closes #116).

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>