Give each failure one error value (closes #113)

internal/cli drops its copies of vault.ErrSecretNotFound, ErrVaultNotFound,
ErrVersionNotFound and ErrSecretExists and of the secret package's keychain
and Secure Enclave errors, and its second error for an unknown unlocker
type, an invalid mnemonic, a length below 1, an unsupported secret type and
an oversized secret. vault.ErrNilValueBuffer becomes
secret.ErrNilValueBuffer. Every error of secret.ReadPassphrase wraps
ErrPassphraseNotRead. ResolveGPGKeyFingerprint returns ErrGPGKeyNotFound for
a key the keyring lacks. storeInKeychain returns errNilDataBuffer. bip85's
ErrPasswordTooShort and ErrEncodedTooShort go with their unreachable checks,
as does the macOS check in macOS-only code. Tests that matched these
errors' text use errors.Is.

Model: opus-5-5

internal/cli/crypto.go

@@ -17,7 +17,6 @@ import (
 var (
 	errNotAgeSecretKey = errors.New(
 		"does not contain a valid age secret key")
-	errSecretDoesNotExist = errors.New("does not exist")
 )
 
 // newCryptoCmd builds an encrypt/decrypt command with input/output flags
@@ -245,7 +244,7 @@ func (cli *Instance) Decrypt(secretName, inputFile, outputFile string) error {
 	}
 
 	if !exists {
-		return fmt.Errorf("secret '%s' %w", secretName, errSecretDoesNotExist)
+		return fmt.Errorf("secret '%s' %w", secretName, vault.ErrSecretNotFound)
 	}
 
 	// Get the age secret key from the secret