When you invoke "tar cfv <tarball> <files>", then tar will close all
active file descriptors it has, forks, then opens the target tarball
as fd 1 (stdout). Then, it'll exec "gzip -", which *inherits* a stdout
which is a file.

Now we duplicate this stdout if it's a regular file so that we can
advise it later. (The original will be closed via the _exit() routine,
probably, which uses direct syscall that we cannot intercept.)