add make setup and network-free deps.check guard

mix deps.get contacts hex.pm even when everything is already installed
(the advisory check), so the everyday loops failed in offline/sandboxed
environments; and the root deps target only installed app's deps, never
blogex's.

make setup (root) installs Hex deps for both apps plus the app's JS
packages, once per clone, explicitly. check, test and test.coverage in
both apps now depend on a local deps.check guard instead: every package
pinned in mix.lock must exist in deps/, else fail loudly pointing at
make setup. AGENTS.md documents the new target.

Makefile

@@ -2,7 +2,7 @@
 
 MISE_BIN ?= mise
 
-.PHONY: check precommit verify hooks deps compile test test-elisp format
+.PHONY: check precommit verify hooks deps setup compile test test-elisp format
 
 # Cheap static gate over both apps, cheapest first. No database, no coverage:
 # this is the loop you run freely while working and before every commit.
@@ -47,9 +47,18 @@ hooks:
 		echo "installed $$hooks_dir/$$name -> $$hook"; \
 	done
 
-# Sync dependencies
-deps:
-	@make -C app deps
+# One-time setup for this clone (and after any mix.exs gains a dependency):
+# fetches Hex deps for both apps and the app's JS packages. Needs network, and
+# is deliberately NOT wired into check/test/verify: `mix deps.get` contacts
+# hex.pm even when everything is already installed (the advisory check), which
+# fails offline/sandboxed. The everyday loops run the per-app `deps.check`
+# guard instead and point here when deps are missing.
+setup:
+	@$(MAKE) -C app MISE_BIN=$(MISE_BIN) deps
+	@$(MAKE) -C blogex MISE_BIN=$(MISE_BIN) deps
+
+# Kept for muscle memory; `setup` is the canonical entry point.
+deps: setup
 
 # Compile the project
 compile: