Inject universal /slim/init instead of requiring container-specific setup

slim now works with any Containerfile by injecting distro-agnostic scripts
at build time:

- /slim/init: mounts special filesystems, configures networking (static
  QEMU slirp), sets up cgroup2, timezone, and rootless container prereqs.
  Parses slim.cmd=<base64> from the kernel cmdline for runtime overrides,
  otherwise execs /slim/exec.

- /slim/exec: generated from the image's CMD/ENTRYPOINT (via podman image
  inspect), overridable via --cmd at build and run time.

Changes:
- New src/inject.rs: inspect image config, infer command, generate
  /slim/exec script, inject /slim/ into mounted rootfs
- New src/scripts/slim-init.sh: the universal init script (include_str!)
- build.rs: rename --init to --cmd, inject scripts before packing,
  drop Meta::save, restructure to ensure unmount always runs
- qemu.rs: hardcode init=/slim/init, add --cmd (base64 on cmdline),
  drop Meta::load, add -no-reboot
- Remove src/meta.rs and meta.toml (no longer needed)
- Cargo.toml: add serde_json + base64, remove unused walkdir + cpio + toml
- Example Containerfiles simplified to plain FROM + CMD
- New example/test.sh for manual verification
- README updated for new workflow

src/scripts/slim-init.sh

@@ -14,35 +14,37 @@ mount -t tmpfs tmpfs /tmp  -o mode=1777
 
 # === cgroup2 ===
 mkdir -p /sys/fs/cgroup
-mount -t cgroup2 none /sys/fs/cgroup 2>/dev/null || true
+mount -t cgroup2 none /sys/fs/cgroup 2>/dev/null || echo "mount cgroup2 failed"
+# shellcheck disable=SC2013 # word-splitting is intentional: controllers are space-separated
 for c in $(cat /sys/fs/cgroup/cgroup.controllers 2>/dev/null); do
-    echo "+$c" > /sys/fs/cgroup/cgroup.subtree_control 2>/dev/null || true
+    echo "+$c" > /sys/fs/cgroup/cgroup.subtree_control 2>/dev/null || echo "enable cgroup controller $c failed"
 done
 
 # === Rootless container prerequisites (best-effort) ===
-mount --make-rshared / 2>/dev/null || true
-chmod u+s /usr/bin/newuidmap /usr/bin/newgidmap 2>/dev/null || true
+mount --make-rshared / 2>/dev/null || echo "make-rshared / failed"
+chmod u+s /usr/bin/newuidmap /usr/bin/newgidmap 2>/dev/null || echo "chmod newuidmap/newgidmap failed"
 
 # === Timezone ===
-ln -sf /usr/share/zoneinfo/Europe/Stockholm /etc/localtime 2>/dev/null || true
+ln -sf /usr/share/zoneinfo/Europe/Stockholm /etc/localtime 2>/dev/null || echo "set timezone failed"
 
 # === Networking (QEMU slirp: guest 10.0.2.15/24, gw 10.0.2.2, dns 10.0.2.3) ===
-ip link set lo up 2>/dev/null || true
-ip link set eth0 up 2>/dev/null || true
-ip addr add 10.0.2.15/24 dev eth0 2>/dev/null || true
-ip route add default via 10.0.2.2 2>/dev/null || true
+ip link set lo up 2>/dev/null || echo "ip link set lo up failed"
+ip link set eth0 up 2>/dev/null || echo "ip link set eth0 up failed"
+ip addr add 10.0.2.15/24 dev eth0 2>/dev/null || echo "ip addr add eth0 failed"
+ip route add default via 10.0.2.2 2>/dev/null || echo "ip route add default failed"
 echo nameserver 10.0.2.3 > /etc/resolv.conf
 
 # === Execute the configured command ===
 # If slim.cmd=<base64> is on the kernel cmdline, decode and exec it.
 # Otherwise, exec /slim/exec (generated from the image's CMD/ENTRYPOINT).
+# shellcheck disable=SC2013 # word-splitting is intentional: cmdline tokens are space-separated
 for tok in $(cat /proc/cmdline 2>/dev/null); do
     case "$tok" in
         slim.cmd=*)
             v=${tok#slim.cmd=}
             decoded=$(printf '%s' "$v" | base64 -d 2>/dev/null) \
                 || decoded=$(printf '%s' "$v" | openssl base64 -d 2>/dev/null) \
-                || true
+                || echo "base64 decode failed"
             if [ -n "$decoded" ]; then
                 exec /bin/sh -c "$decoded"
             fi