Stop vault creation when a vault's metadata cannot be read (closes #140)

GetNextDerivationIndex passed over a vault whose vault-metadata.json could
not be read or parsed, so the next vault made from the same mnemonic could
get that vault's derivation index and so the same long-term key. It now
returns an error naming the file, and vault create, vault import and init
stop before writing anything. A vault directory with no metadata file is
still passed over.

The regression test corrupts one vault's metadata and requires CreateVault
with the same mnemonic to fail, naming the file, and leave no new vault.

Unverified by test: an unreadable metadata file; checked by hand only.

Model: opus-5-5

TODO.md

@@ -18,6 +18,13 @@ https://git.eeqj.de/sneak/secret/milestone/12
 
 # Completed Steps
 
+- 2026-10-14: Creating a vault, or importing a mnemonic into one, fails with an
+  error naming the file when any vault's `vault-metadata.json` exists but cannot
+  be read or parsed, and writes nothing
+  (https://git.eeqj.de/sneak/secret/issues/140). `vault.GetNextDerivationIndex`
+  passed over such a vault, so the next vault made from the same mnemonic could
+  be given its derivation index, and so its long-term key. A vault directory
+  with no `vault-metadata.json` is still passed over.
 - 2026-10-14: The passphrase and mnemonic prompts ask on the controlling
   terminal (`/dev/tty`) instead of stdin, so `echo v | secret add s1 --force`,
   `cat file | secret encrypt key` and `cat file.age | secret decrypt key` ask