don't leak a file descriptor to os.devnull by default (#13162)

* don't leak a file descriptor to os.devnull by default

since this is passed along to subprocess directly we can use the subprocess constants still

regression in #12103

* adjust condition for closing as well

NOKEYCHECK=True
GitOrigin-RevId: eb0a32195277dfb6f058ce7ed6cd16322bd36067
1 file changed