spawn: more CLOEXEC fixes