A TOYFLAG_NOFORK command must run in the context of toysh, but a MAYFORK
can either run standalone or run in the toysh process. MAYFORK means it
cleans up after itself: no leaked resources (malloc, mmap, filehandles, etc),
even in error_exit() paths that would longjmp() back to the shell. It also
doesn't discard anything we need to retain (don't close stdout, change
toys.optargs[] so we can't free it, etc)...
