• popen is also used in portable utilities (here, jupp) so we cannot
  rely on being allowed to use 'sh -c -- "cmd"' so, unless permitted
  (by defining POPEN_SH_USE_DBLDASH or being MirBSD), if the command
  begins with ‘-’ or ‘+’ prefix a space (malloc/memcpy)
• GCC’s vfork warnings get annoying here, so factor vfork out into a
  static subroutine for the child case (error and parent cases stay)
• some code cleanup
• retain errno across error cleanup codepath (also in system)
• avoid compiler warnings due to broken execve(2) API, from mksh
• system.c is now const‑ and warning-clean