These file descriptors are being leaked to child processes because
O_CLOEXEC isn't set.

Add Watcher.AddNonRecursive for raw kqueue event masks without the directory child-watching behavior used to mimic inotify.

Track non-recursive directory watches so directory NOTE_WRITE events are delivered directly instead of triggering child scans later. This is useful for device directories such as /dev where opening existing entries can fail with EBUSY.

Validation: go test -run TestAddNonRecursiveDoesNotWatchChildren; go test -run TestRemoveState