run-command: block signals between fork and execve