Makefile: use a minimal whitelist of env vars