compile deps in make setup so cold clones stay offline

Some deps download artifacts at compile time: rustler_precompiled
fetches the mdex_native NIF from GitHub during its first compile, and
NimblePublisher pulls mdex_native into both apps. Compiling inside the
deps target keeps that traffic inside setup - the explicit user-run
network step - instead of the first make check/test on a fresh clone.

AGENTS.md

@@ -71,10 +71,11 @@ This is a Phoenix Liveview monorepo, the blogging library is in blogex, the appl
 Main make targets:
 
 - `make setup` - one-time clone setup (and after any mix.exs gains a dep):
-  fetches Hex deps for both apps and the app's JS packages. Needs network -
+  fetches Hex deps for both apps, the app's JS packages, and compiles deps
-  run it yourself; agent sandboxes refuse installs. check/test/verify never
+  (some deps fetch artifacts at compile time, e.g. the mdex_native NIF).
-  touch the network: they run a local `deps.check` guard that fails with a
+  Needs network - run it yourself; agent sandboxes refuse installs.
-  pointer here when deps are missing.
+  check/test/verify never touch the network: they run a local `deps.check`
+  guard that fails with a pointer here when deps are missing.
 - `make check` - cheap static gate for both apps (no DB): app `credo --strict` +
   format **check** (`mix format --check-formatted`), blogex compile (warnings
   fatal) + format **check**, then `scripts/check-pins.sh`. It never rewrites

app/Makefile

@@ -24,9 +24,17 @@ assets:
 	@test -f assets/node_modules/.package-lock.json || \
 		(echo "==> assets: npm install (first run)"; cd assets && npm install)
 
-# Sync dependencies (Hex packages + JS packages)
+# Sync dependencies (Hex packages + JS packages) and compile them. The compile
+# step is part of setup on purpose: some deps download artifacts at compile
+# time - rustler_precompiled fetches the mdex_native NIF from GitHub during
+# its first compile, and NimblePublisher pulls mdex_native into this app. Keep
+# that traffic in this explicit, user-run step so check/test/verify stay
+# offline even on a cold clone. (rustler_precompiled caches artifacts globally
+# in ~/Library/Caches/rustler_precompiled, so later test-env compiles find
+# them without network.)
 deps: assets
 	$(MISE_EXEC) mix deps.get
+	$(MISE_EXEC) mix deps.compile
 
 # Local, network-free guard: every package pinned in mix.lock must be present
 # in deps/. check, test and test.coverage depend on this instead of `deps`, so

blogex/Makefile

@@ -22,9 +22,13 @@ check: deps.check compile format.check
 precommit:
 	$(MISE_EXEC) mix precommit
 
-# Sync dependencies
+# Sync dependencies and compile them: NimblePublisher pulls in mdex_native,
+# whose precompiled NIF downloads from GitHub at first compile. Keeping that
+# in `deps` (called by root `make setup`) keeps check/test/verify offline on
+# a cold clone.
 deps:
 	$(MISE_EXEC) mix deps.get
+	$(MISE_EXEC) mix deps.compile
 
 # Local, network-free guard: every package pinned in mix.lock must be present
 # in deps/. check, test and test.coverage depend on this instead of `deps`, so