[kazu-yamamoto]

Fix #625.

The fix goes further than adding MSG_CMSG_CLOEXEC as a MsgFlag that callers can pass. recvBufMsg, which recvMsg, recvMsgWith and recvFd all go through, now always makes the descriptors it receives close-on-exec. This matches what accept returns, which is already close-on-exec on POSIX and, since #655, non-inheritable on Windows.

• Where MSG_CMSG_CLOEXEC exists (Linux, the BSDs), it is always passed to recvmsg, so the kernel marks the descriptors atomically. Linux echoes the flag back in msg_flags, so it is masked out of the returned flags.
• Where it does not exist (macOS), the descriptors in SCM_RIGHTS messages are marked right after the receive. This still leaves a window, but it is shorter than what callers could manage themselves.
• The Haddocks of recvBufMsg, recvMsg and recvFd say so.
• The sendFd/recvFd test checks that the received descriptor is close-on-exec.

This is a behaviour change: code that hands a received descriptor to a child through exec has to clear the flag itself. Windows is unaffected.

Tested on macOS and on Rocky Linux (GHC 9.12.4).

🤖 Generated with Claude Code