> I wonder if the best solution lies somewhere in the vicinity of "fork but only copy a small part of the address space"

I think the best solution would be if every relevant syscall took a process handle, so you can run it either in the current process or in a non-started child process

That's not going to happen on Linux because it would be a radical change to the Linux syscall API. But if one were designing an OS from scratch today I think it would make sense to do things that way.