Check errors by identity, not by message text, in tests (closes #49)

Tests that asserted a failure by a fragment of its message now use
errors.Is: a refactor returning the wrong error, or wrapping with %v
instead of %w, now fails them. New tests return each exported error of
internal/vault and pkg/bip85 that no test returned, and check wrapped
causes (os.ErrNotExist, ErrMnemonicMismatch through GetSecret,
ErrInvalidPathComponent through DeriveBIP85Entropy). The 999-versions
test moves into package secret to name its unexported error. Checks of
errors no test can name keep their text; they are listed on the issue.

Model: opus-5-5

internal/vault/path_traversal_test.go

@@ -41,10 +41,8 @@ func TestGetSecretVersionRejectsPathTraversal(t *testing.T) {
 			t.Parallel()
 
 			_, err := vlt.GetSecretVersion(name, "")
-			require.Error(t, err,
+			require.ErrorIs(t, err, vault.ErrInvalidSecretName,
 				"GetSecretVersion should reject malicious name: %s", name)
-			require.Contains(t, err.Error(), "invalid secret name",
-				"error should indicate invalid name for: %s", name)
 		})
 	}
 }
@@ -61,8 +59,7 @@ func TestGetSecretRejectsPathTraversal(t *testing.T) {
 	require.NoError(t, err)
 
 	_, err = vlt.GetSecret("../../../etc/passwd")
-	require.Error(t, err)
-	require.Contains(t, err.Error(), "invalid secret name")
+	require.ErrorIs(t, err, vault.ErrInvalidSecretName)
 }
 
 // TestGetSecretObjectRejectsPathTraversal verifies GetSecretObject
@@ -87,8 +84,8 @@ func TestGetSecretObjectRejectsPathTraversal(t *testing.T) {
 			t.Parallel()
 
 			_, err := vlt.GetSecretObject(name)
-			require.Error(t, err, "GetSecretObject should reject: %s", name)
-			require.Contains(t, err.Error(), "invalid secret name")
+			require.ErrorIs(t, err, vault.ErrInvalidSecretName,
+				"GetSecretObject should reject: %s", name)
 		})
 	}
 }