build: add -E to sudo invocation in top-level Makefile