hush: use FEATURE_SH_NOFORK to enable NOFORK trick