build(make): prove make setup actually works before exiting 0 (T-47)

pip install exiting 0 is not evidence the gateway environment is usable
(D-24) — a resolved-but-broken dependency or a stale venv from another
Python both look identical to a clean install at the point setup exits.
End the target with a cheap positive check instead: collect the test
suite (imports every src module each test pulls in) and confirm ruff
and mypy resolve inside the venv, the only place either binary exists.

Also states explicitly, in a comment, that setup covers the gateway
half only — the firmware half needs `source ~/esp-idf/export.sh` in
every shell, which a Makefile recipe cannot leave sourced in the
caller's shell, so build-firmware sources it itself instead.

CHANGELOG.md

@@ -14,6 +14,9 @@ until the first tagged release.
   removed. `make test` means the same thing from any directory.
 - Firmware targets source `~/esp-idf/export.sh` themselves, so `idf.py` resolves without
   having to remember. Override the location with `IDF_EXPORT=`.
+- `make setup` now proves the gateway environment actually works instead of trusting a
+  clean `pip install` exit code: it collects the test suite and checks `ruff`/`mypy`
+  resolve in the venv, and fails the target if any of that is broken (T-47).
 
 ## [0.2.2] — 2026-07-19