build: use .ONESHELL

By using .ONESHELL and adding -e to .SHELLFLAGS, we can simplify complex
shell commands (like manifest generation) and gain a simple way to pass
multi-line environment variables into shell commands.

The @ and + flags for recipe commands are moved to the top of each
recipe.