Check errors by identity, not by message text, in tests (closes #49)

Tests that asserted a failure by a fragment of its message now use
errors.Is: a refactor returning the wrong error, or wrapping with %v
instead of %w, now fails them. New tests return each exported error of
internal/vault and pkg/bip85 that no test returned, and check wrapped
causes (os.ErrNotExist, ErrMnemonicMismatch through GetSecret,
ErrInvalidPathComponent through DeriveBIP85Entropy). The 999-versions
test moves into package secret to name its unexported error. Checks of
errors no test can name keep their text; they are listed on the issue.

Model: opus-5-5

TODO.md

@@ -18,6 +18,13 @@ https://git.eeqj.de/sneak/secret/milestone/12
 
 # Completed Steps
 
+- 2026-10-04: Tests check which error a failure returns with `errors.Is`,
+  not by matching words of its message
+  (https://git.eeqj.de/sneak/secret/issues/49). Every exported error of
+  `internal/vault` and `pkg/bip85` that can be returned has a test that the
+  function returns it, and errors wrapping a cause are checked through the
+  wrapping. Checks that still match text, because the error has no exported
+  value the test can name, are listed on the issue.
 - 2026-10-04: An unlocker's ID is the name of its directory in `unlockers.d`,
   so no two unlockers of a vault share one
   (https://git.eeqj.de/sneak/secret/issues/98). Before, a keychain or Secure