ci(make): reserve exit 69 for "could not run" (D-26)

Environment guards now exit 69 rather than 1, so a caller can tell a suite
that could not start from one that ran and failed. The first toj test sweep
reported "3 repositories failed" and none of the three had executed a test —
two could not find go, one had no venv. That points the reader at the tests
when the fault is in the environment.

Only the environment guards change. A gitleaks finding, a failed test run and
a vulncheck hit still exit 1, because those did run and did fail.

Co-Authored-By: Claude <noreply@anthropic.com>

Makefile

@@ -76,12 +76,12 @@ typecheck: ## mypy over the gateway sources
 
 .PHONY: build-firmware
 build-firmware: ## Build the ESP-IDF firmware (sources export.sh for you)
-	@test -f $(IDF_EXPORT) || { echo "FAIL — no ESP-IDF at $(IDF_EXPORT); set IDF_EXPORT=<path>/export.sh"; exit 1; }
+	@test -f $(IDF_EXPORT) || { echo "FAIL — no ESP-IDF at $(IDF_EXPORT); set IDF_EXPORT=<path>/export.sh"; exit 69; }
 	. $(IDF_EXPORT) && cd firmware && idf.py build
 
 .PHONY: flash
 flash: ## Flash and monitor the device (PORT=/dev/ttyACM0 by default)
-	@test -f $(IDF_EXPORT) || { echo "FAIL — no ESP-IDF at $(IDF_EXPORT); set IDF_EXPORT=<path>/export.sh"; exit 1; }
+	@test -f $(IDF_EXPORT) || { echo "FAIL — no ESP-IDF at $(IDF_EXPORT); set IDF_EXPORT=<path>/export.sh"; exit 69; }
 	. $(IDF_EXPORT) && cd firmware && idf.py -p $(or $(PORT),/dev/ttyACM0) flash monitor
 
 # --- sim ----------------------------------------------------------------------