Fix U3: escape commas in --mount path for QEMU -virtfs

QEMU QemuOpts splits on commas; escape literal commas in the host
path as ,, per QEMU convention to prevent option injection and
boot failures on paths containing commas.

Fix U5: extract b64dec() helper in slim-init.sh

Deduplicate the 3-line base64 fallback decode block used by both
the slim.mount and slim.cmd handlers into a single b64dec() function.

Fix U6: add multi-mount test case

test_mount now passes two --mount flags and asserts both slim0
and slim1 9p tags appear, covering the multi-mount tag-generation
path.

src/qemu.rs

@@ -101,9 +101,12 @@ pub(crate) fn run(
         let tag = format!("slim{i}");
         let dest_b64 = base64::engine::general_purpose::STANDARD.encode(path_str.as_bytes());
 
+        // QEMU's QemuOpts splits on commas — escape literal commas in the
+        // path as ",," per QEMU convention.
+        let path_escaped = path_str.replace(',', ",,");
         virtfs_args.push("-virtfs".into());
         virtfs_args.push(format!(
-            "local,path={path_str},mount_tag={tag},security_model=mapped-xattr"
+            "local,path={path_escaped},mount_tag={tag},security_model=mapped-xattr"
         ));
         cmdline.push(format!("slim.mount={tag}:{dest_b64}"));
     }