Give each failure one error value (closes #113)

internal/cli drops its copies of vault.ErrSecretNotFound, ErrVaultNotFound,
ErrVersionNotFound and ErrSecretExists and of the secret package's keychain
and Secure Enclave errors, and its second error for an unknown unlocker
type, an invalid mnemonic, a length below 1, an unsupported secret type and
an oversized secret. vault.ErrNilValueBuffer becomes
secret.ErrNilValueBuffer. Every error of secret.ReadPassphrase wraps
ErrPassphraseNotRead. ResolveGPGKeyFingerprint returns ErrGPGKeyNotFound for
a key the keyring lacks. storeInKeychain returns errNilDataBuffer. bip85's
ErrPasswordTooShort and ErrEncodedTooShort go with their unreachable checks,
as does the macOS check in macOS-only code. Tests that matched these
errors' text use errors.Is.

Model: opus-5-5

internal/cli/vault.go

@@ -23,7 +23,6 @@ import (
 var (
 	errMnemonicEmpty         = errors.New("mnemonic cannot be empty")
 	errInvalidMnemonicPhrase = errors.New("invalid BIP39 mnemonic phrase")
-	errInvalidMnemonic       = errors.New("invalid BIP39 mnemonic")
 	errVaultHasLongTermKey   = errors.New(
 		"already has a long-term key configured")
 	errMnemonicEnvNotSet = errors.New(
@@ -250,7 +249,7 @@ func (cli *Instance) resolvePassphrase() (*memguard.LockedBuffer, func(), error)
 	// Use secure passphrase input with confirmation
 	passphraseBuffer, err := readSecurePassphrase("Enter passphrase for unlocker: ")
 	if err != nil {
-		return nil, nil, fmt.Errorf("failed to read passphrase: %w", err)
+		return nil, nil, err
 	}
 
 	return passphraseBuffer, passphraseBuffer.Destroy, nil
@@ -353,7 +352,7 @@ func (cli *Instance) vaultImportPreflight(
 
 	if !exists {
 		return "", "", "", fmt.Errorf("vault '%s' %w",
-			vaultName, errVaultDoesNotExist)
+			vaultName, vault.ErrVaultNotFound)
 	}
 
 	// Check if vault already has a public key
@@ -381,7 +380,7 @@ func (cli *Instance) vaultImportPreflight(
 	secret.Debug("Validating BIP39 mnemonic", "word_count", len(mnemonicWords))
 
 	if !bip39.IsMnemonicValid(mnemonic) {
-		return "", "", "", errInvalidMnemonic
+		return "", "", "", errInvalidMnemonicPhrase
 	}
 
 	return vaultDir, pubKeyPath, mnemonic, nil
@@ -644,7 +643,7 @@ func (cli *Instance) findVaultToRemove(name string) (vaultToRemove, error) {
 
 	if !slices.Contains(vaults, name) {
 		return vaultToRemove{},
-			fmt.Errorf("vault '%s' %w", name, errVaultDoesNotExist)
+			fmt.Errorf("vault '%s' %w", name, vault.ErrVaultNotFound)
 	}
 
 	if len(vaults) == 1 {