executable: fix DuplicateProcess...

if a running process has it's binary deleted/replaced, the symlink
will contain a " (deleted)" substring. rather than testing a hard ==,
we check strings.HasPrefix