add make setup and network-free deps.check guard

mix deps.get contacts hex.pm even when everything is already installed
(the advisory check), so the everyday loops failed in offline/sandboxed
environments; and the root deps target only installed app's deps, never
blogex's.

make setup (root) installs Hex deps for both apps plus the app's JS
packages, once per clone, explicitly. check, test and test.coverage in
both apps now depend on a local deps.check guard instead: every package
pinned in mix.lock must exist in deps/, else fail loudly pointing at
make setup. AGENTS.md documents the new target.

AGENTS.md

@@ -70,6 +70,11 @@ This is a Phoenix Liveview monorepo, the blogging library is in blogex, the appl
 
 Main make targets:
 
+- `make setup` - one-time clone setup (and after any mix.exs gains a dep):
+  fetches Hex deps for both apps and the app's JS packages. Needs network -
+  run it yourself; agent sandboxes refuse installs. check/test/verify never
+  touch the network: they run a local `deps.check` guard that fails with a
+  pointer here when deps are missing.
 - `make check` - cheap static gate for both apps (no DB): app `credo --strict` +
   format **check** (`mix format --check-formatted`), blogex compile (warnings
   fatal) + format **check**, then `scripts/check-pins.sh`. It never rewrites