Check errors by identity, not by message text, in tests (closes #49)

Tests that asserted a failure by a fragment of its message now use
errors.Is: a refactor returning the wrong error, or wrapping with %v
instead of %w, now fails them. New tests return each exported error of
internal/vault and pkg/bip85 that no test returned, and check wrapped
causes (os.ErrNotExist, ErrMnemonicMismatch through GetSecret,
ErrInvalidPathComponent through DeriveBIP85Entropy). The 999-versions
test moves into package secret to name its unexported error. Checks of
errors no test can name keep their text; they are listed on the issue.

Model: opus-5-5

TODO.md

@@ -18,6 +18,13 @@ https://git.eeqj.de/sneak/secret/milestone/12
 
 # Completed Steps
 
+- 2026-10-04: Tests check which error a failure returns with `errors.Is`,
+  not by matching words of its message
+  (https://git.eeqj.de/sneak/secret/issues/49). Every exported error that
+  can be returned has a test that the function returns it, and errors
+  wrapping a cause are checked through the wrapping. Checks that still match
+  text, because the error has no exported value the test can name, are
+  listed on the issue.
 - 2026-10-04: When a vault cannot be opened through its current unlocker,
   because a file the unlocker needs is missing or damaged, its keychain item
   or Secure Enclave key is gone, or the passphrase is wrong, the error now