everywhere: always use O_CLOEXEC where it makes sense