fix: prevent IPC socket fd leak into child processes

[Anntoin]

Problem

Keymapper creates an abstract Unix domain socket (@keymapperctl) for IPC between the client and daemon. This socket fd is inherited by child processes spawned via $(...) config commands (e.g. kitty, tofi, swaymsg).

These children keep the socket fd open and listening. When keymapper is restarted (e.g. by a service manager, or config reload), the new process cannot bind @keymapperctl because the leaked processes still hold it. This produces Binding control port failed errors and keybindings stop working until all the leaked processes are manually killed.

Root Cause

All socket() calls in Host.cpp use plain SOCK_STREAM without SOCK_CLOEXEC, so the fd survives exec() into child processes.

Fix

Add SOCK_CLOEXEC to all Unix socket calls in Host.cpp:

• listen(): socket(AF_UNIX, SOCK_STREAM | SOCK_CLOEXEC, 0)
• accept(): use accept4() with SOCK_CLOEXEC when available (detected via __GLIBC_PREREQ(2,10) for glibc; musl provides it without any feature-test macro), fall back to accept() + fcntl(FD_CLOEXEC) otherwise
• connect(): SOCK_CLOEXEC on both initial and retry socket() calls

Testing

• Verified accept4 and SOCK_CLOEXEC present in the built binary via objdump / nm -D
• Confirmed spawned terminals (kitty) no longer appear in ss -xlp output for @keymapperctl after keymapper restart
• Service restarts cleanly without Binding control port failed
• Tested on Linux x86_64 with keymapper 5.6.0

Compatibility

• accept4 availability is detected via __GLIBC_PREREQ(2,10) for glibc. On musl it is available without _GNU_SOURCE. Other platforms (macOS, BSD) fall back to accept() + fcntl(FD_CLOEXEC).
• No behaviour change for existing users — CLOEXEC only affects exec(), not normal fd lifetime.