add make setup and network-free deps.check guard

mix deps.get contacts hex.pm even when everything is already installed
(the advisory check), so the everyday loops failed in offline/sandboxed
environments; and the root deps target only installed app's deps, never
blogex's.

make setup (root) installs Hex deps for both apps plus the app's JS
packages, once per clone, explicitly. check, test and test.coverage in
both apps now depend on a local deps.check guard instead: every package
pinned in mix.lock must exist in deps/, else fail loudly pointing at
make setup. AGENTS.md documents the new target.

blogex/Makefile

@@ -3,17 +3,19 @@
 MISE_BIN ?= mise
 MISE_EXEC = $(MISE_BIN) exec --
 
-.PHONY: check precommit deps compile test test.coverage coverage crap format format.check verify
+.PHONY: check precommit deps deps.check compile test test.coverage coverage crap format format.check verify
 
-# Cheap static gate for this library (no database, no coverage). Runs from the
-# root `make check`, which loops app then blogex. `format.check` only reports:
+# Cheap static gate for this library (no database, no network, no coverage).
+# The deps.check guard fails loudly with a pointer at `make setup` when Hex
+# deps are missing. Runs from the root `make check`, which loops app then
+# blogex. `format.check` only reports:
 # a gate that rewrites the files it judges can never fail. Fix formatting with
 # `make format`.
 #
 # Sensor slot: add `credo` once the "credo strict, tuned config (both apps)"
 # yak lands blogex's credo dep + .credo.exs. Do not list it before then — a
 # gate that claims a check it did not run is worse than no gate.
-check: compile format.check
+check: deps.check compile format.check
 
 # Per-app precommit loop: same target name and alias shape as app/, so both
 # apps share one habit (compile --warning-as-errors, format, test).
@@ -24,18 +26,32 @@ precommit:
 deps:
 	$(MISE_EXEC) mix deps.get
 
+# Local, network-free guard: every package pinned in mix.lock must be present
+# in deps/. check, test and test.coverage depend on this instead of `deps`, so
+# the everyday loops never touch the network: `mix deps.get` contacts hex.pm
+# even when everything is already installed (the advisory check), which fails
+# in offline/sandboxed environments. Fetching is `make setup`'s explicit job,
+# run from the repo root.
+deps.check:
+	@test -f mix.lock || { echo "deps.check: no mix.lock - run 'make setup' at the repo root" >&2; exit 1; }
+	@missing=""; \
+	for dep in $$(sed -n 's/^[[:space:]]*"\([^"]*\)".*/\1/p' mix.lock); do \
+		[ -d "deps/$$dep" ] || missing="$$missing $$dep"; \
+	done; \
+	test -z "$$missing" || { echo "deps.check: missing:$$missing - run 'make setup' at the repo root" >&2; exit 1; }
+
 # Compile the project (warnings are fatal)
 compile:
 	$(MISE_EXEC) mix compile --warnings-as-errors
 
 # Run the test suite
-test: deps
+test: deps.check
 	$(MISE_EXEC) mix test
 
 # Run the suite once with coverage exported, so the coverage floor check (and,
 # later, CRAP) reads the export instead of running the suite a second time.
 # Stale exports are removed first: the floor must never report an older run.
-test.coverage: deps
+test.coverage: deps.check
 	rm -f cover/*.coverdata
 	$(MISE_EXEC) mix test --cover --export-coverage default