daemon: use Popen with close_fds=True