Function cbm_posix_child_exec

src/foundation/subprocess.c:905–931

fork+exec child setup. On Apple this runs ONLY for the exec-failure * fallback (see cbm_posix_spawn_apple), which preserves the documented * "bogus binary => child exits 127" contract across platforms. */

 * fallback (see cbm_posix_spawn_apple), which preserves the documented
 * "bogus binary => child exits 127" contract across platforms. */
static void cbm_posix_child_exec(cbm_subprocess_t *process, int input, int output, long max_fd) {
    if (setpgid(0, 0) < 0) {
        _exit(127);
    }
    cbm_posix_reset_child_signals();

    /* Never let a worker consume the MCP transport inherited as stdin. Only
     * async-signal-safe calls are used between fork and exec. */
    if (input < 0 || output < 0 || dup2(input, STDIN_FILENO) < 0 ||
        dup2(output, STDOUT_FILENO) < 0 || dup2(output, STDERR_FILENO) < 0) {
        _exit(127);
    }
    if (input > STDERR_FILENO) {
        (void)close(input);
    }
    if (output > STDERR_FILENO) {
        (void)close(output);
    }
    for (int fd = STDERR_FILENO + 1; fd < max_fd; fd++) {
        (void)close(fd);
    }
    /* A fixed literal tool name (for example "git" or "curl") uses the
     * caller's normal PATH without introducing a shell. An explicit path
     * still has execvp's exact-path semantics because it contains '/'. */
    execvp(process->bin, process->argv);
    _exit(127);
}

static int cbm_posix_fd_at_least_three(int fd) {
    if (fd < 0 || fd > STDERR_FILENO) {