notification: double-fork children

this allows waiting for the first child (for we can't just ignore child
signals), and the notify process itself can die in peace later without
becoming a zombie.
dissect pam-ssh-agent-auth's sudo details if present