io: use qemu_accept to ensure SOCK_CLOEXEC is set