Check errors by identity, not by message text, in tests (closes #49)

Tests that asserted a failure by a fragment of its message now use
errors.Is: a refactor returning the wrong error, or wrapping with %v
instead of %w, now fails them. New tests return each exported error of
internal/vault and pkg/bip85 that no test returned, and check wrapped
causes (os.ErrNotExist, ErrMnemonicMismatch through GetSecret,
ErrInvalidPathComponent through DeriveBIP85Entropy). The 999-versions
test moves into package secret to name its unexported error. Checks of
errors no test can name keep their text; they are listed on the issue.

Model: opus-5-5

internal/vault/integration_test.go

@@ -2,6 +2,7 @@ package vault_test
 
 import (
 	"bytes"
+	"errors"
 	"os"
 	"path/filepath"
 	"slices"
@@ -341,9 +342,9 @@ func testVaultNameValidation(t *testing.T, fs afero.Fs, tempDir string) {
 
 	for _, name := range invalidNames {
 		_, err := vault.CreateVault(fs, stateDir, name, testMnemonicBuffer(t), nil)
-		if err == nil {
-			t.Errorf("Expected error creating vault with invalid name %q, "+
-				"but got none", name)
+		if !errors.Is(err, vault.ErrInvalidVaultName) {
+			t.Errorf("Expected ErrInvalidVaultName creating vault with "+
+				"invalid name %q, got %v", name, err)
 		}
 	}
 }