build: let a failed pin check decide the exit status everywhere

fd627b1's message said the rewrite hardened a pin check that used `;`
where it needed `&&`. It hardened one of four. Three recipes still
ended their chain with `echo "==> ... done"; ` after a semicolon, so a
mismatched pin failed the `test`, skipped every build step, and then
ran the echo anyway -- exit 0, and make announced a pinned dependency
that nothing had verified. deps-windows also had the same break after
mkdir and after `make randomx`.

The one the earlier message did not mention is deps-secp256k1, on the
Linux path: libsecp256k1 is signature verification, so that was the
worst of the three to leave reporting success on an unverified
checkout.

Joined each chain with && the whole way to the closing echo, in
deps-secp256k1, and in both halves of deps-windows.

Verified by extracting each recipe as make expands it, splitting it
into logical recipe lines and running each in its own shell the way
make does, with git reporting a sha that does not match the pin: all
three previously exited 0 and now exit 1, and each deps-windows half
fails independently rather than relying on the other. With a matching
sha the recipes still exit 0, still print "done", and still write the
marker. The Windows path was not executed -- there is no MSYS2 here --
so pacman was shimmed and only the shell logic below it was measured.

1 files changed, 16 insertions, 10 deletions

diff --git a/Makefile b/Makefile
index c891001..c5cf31c 100644
--- a/Makefile
+++ b/Makefile
@@ -37,6 +37,12 @@ VERSION := 1.2.19+sec
 # resolves the object by its own hash). Bump deliberately, and rebuild and
 # resync before shipping the result.
 #
+# The check has to decide the exit status, so each recipe below joins its
+# commands with && the whole way to the closing echo. Ending that chain with a
+# `;` meant a failed `test` only skipped the build steps: the echo still ran,
+# the target still exited 0, and make announced a pinned dependency that
+# nothing had verified.
+#
 # RandomX pin is the commit this tree has been building and syncing against
 # (post-v2.0.1 master, 2026-05-24) -- identical to upstream's pin.
 #
@@ -123,8 +129,8 @@ deps-apt:
 deps-secp256k1:
         @if [ ! -f /usr/local/lib/libsecp256k1.a ]; then \
           echo "==> building libsecp256k1"; \
-          rm -rf $(ROOT)/secp256k1-build; \
-          git init -q $(ROOT)/secp256k1-build; \
+          rm -rf $(ROOT)/secp256k1-build && \
+          git init -q $(ROOT)/secp256k1-build && \
           cd $(ROOT)/secp256k1-build && \
           git remote add origin $(SECP256K1_REPO) && \
           git fetch -q --depth 1 origin $(SECP256K1_COMMIT) && \
@@ -134,7 +140,7 @@ deps-secp256k1:
           cd $(ROOT)/secp256k1-build && ./autogen.sh && \
           ./configure --enable-module-schnorrsig --enable-module-extrakeys \
             --disable-shared --with-pic --disable-benchmark --disable-tests && \
-          make -j$(NPROC) && $(SUDO) make install && $(SUDO) ldconfig; \
+          make -j$(NPROC) && $(SUDO) make install && $(SUDO) ldconfig && \
           echo "==> libsecp256k1 done"; \
         else \
           echo "==> libsecp256k1 already installed"; \
@@ -252,8 +258,8 @@ deps-windows:
           mingw-w64-ucrt-x86_64-cmake \
           autoconf automake libtool
         @if [ ! -f deps/lib/libsecp256k1.a ]; then \
-          rm -rf secp256k1-build; \
-          git init -q secp256k1-build; \
+          rm -rf secp256k1-build && \
+          git init -q secp256k1-build && \
           cd secp256k1-build && \
           git remote add origin $(SECP256K1_REPO) && \
           git fetch -q --depth 1 origin $(SECP256K1_COMMIT) && \
@@ -264,23 +270,23 @@ deps-windows:
           ./configure --prefix=$(ROOT)/deps \
             --enable-module-schnorrsig --enable-module-extrakeys \
             --disable-shared --with-pic --disable-benchmark --disable-tests && \
-          make install; \
+          make install && \
           echo "==> secp256k1 done"; \
         else \
           echo "==> secp256k1 already built"; \
         fi
         @if [ ! -f RandomX/build/librandomx.a ]; then \
-          rm -rf RandomX; \
-          git init -q RandomX; \
+          rm -rf RandomX && \
+          git init -q RandomX && \
           cd RandomX && \
           git remote add origin $(RANDOMX_REPO) && \
           git fetch -q --depth 1 origin $(RANDOMX_COMMIT) && \
           git checkout -q --detach FETCH_HEAD && \
           test "$$(git rev-parse HEAD)" = "$(RANDOMX_COMMIT)" && \
           echo "==> RandomX pinned at $(RANDOMX_COMMIT)" && \
-          mkdir -p $(ROOT)/RandomX/build; \
+          mkdir -p $(ROOT)/RandomX/build && \
           cd $(ROOT)/RandomX/build && cmake .. -G "Unix Makefiles" -DCMAKE_BUILD_TYPE=Release && \
-          make randomx; \
+          make randomx && \
           echo "==> RandomX done"; \
         else \
           echo "==> RandomX already built"; \