Check errors by identity, not by message text, in tests (closes #49)

Tests that asserted a failure by a fragment of its message now use
errors.Is: a refactor returning the wrong error, or wrapping with %v
instead of %w, now fails them. New tests return each exported error of
internal/vault and pkg/bip85 that no test returned, and check wrapped
causes (os.ErrNotExist, ErrMnemonicMismatch through GetSecret,
ErrInvalidPathComponent through DeriveBIP85Entropy). The 999-versions
test moves into package secret to name its unexported error. Checks of
errors no test can name keep their text; they are listed on the issue.

Model: opus-5-5

pkg/agehd/agehd_test.go

@@ -38,7 +38,6 @@ const (
 	testMessageLargePattern  = "A"
 
 	// Error messages for validation
-	errorMsgNeed32Bytes = "need 32-byte scalar, got"
 	errorMsgInvalidXPRV = "invalid-xprv"
 
 	// Test constants for various scenarios
@@ -330,24 +329,17 @@ func TestClampFunction(t *testing.T) {
 	}
 }
 
-// requireIdentityError asserts that identity derivation failed with an
-// error containing errorMsg and returned no identity.
+// requireIdentityError asserts that identity derivation failed with
+// errInvalidScalarSize and returned no identity.
 func requireIdentityError(
 	t *testing.T,
 	identity *age.X25519Identity,
 	err error,
-	errorMsg string,
 ) {
 	t.Helper()
 
-	if err == nil {
-		t.Errorf("expected error but got none")
-	} else if !strings.Contains(err.Error(), errorMsg) {
-		t.Errorf(
-			"expected error containing %q, got %q",
-			errorMsg,
-			err.Error(),
-		)
+	if !errors.Is(err, errInvalidScalarSize) {
+		t.Errorf("expected errInvalidScalarSize, got %v", err)
 	}
 
 	if identity != nil {
@@ -363,31 +355,26 @@ func TestIdentityFromEntropyEdgeCases(t *testing.T) {
 		name        string
 		entropy     []byte
 		expectError bool
-		errorMsg    string
 	}{
 		{
 			name:        "nil entropy",
 			entropy:     nil,
 			expectError: true,
-			errorMsg:    errorMsgNeed32Bytes + " 0",
 		},
 		{
 			name:        "empty entropy",
 			entropy:     []byte{},
 			expectError: true,
-			errorMsg:    errorMsgNeed32Bytes + " 0",
 		},
 		{
 			name:        "too short entropy",
 			entropy:     make([]byte, 31),
 			expectError: true,
-			errorMsg:    errorMsgNeed32Bytes + " 31",
 		},
 		{
 			name:        "too long entropy",
 			entropy:     make([]byte, 33),
 			expectError: true,
-			errorMsg:    errorMsgNeed32Bytes + " 33",
 		},
 		{
 			name:        "valid 32-byte entropy",
@@ -419,7 +406,7 @@ func TestIdentityFromEntropyEdgeCases(t *testing.T) {
 			identity, err := IdentityFromEntropy(tt.entropy)
 
 			if tt.expectError {
-				requireIdentityError(t, identity, err, tt.errorMsg)
+				requireIdentityError(t, identity, err)
 
 				return
 			}