Give each failure one error value (closes #113)

internal/cli's copies of vault.ErrSecretNotFound, ErrVaultNotFound,
ErrVersionNotFound and ErrSecretExists are removed; the commands wrap the
vault errors. errUnsupportedUnlockerType is removed for
errInvalidUnlockerType, which names the same failure. Every error of
secret.ReadPassphrase wraps ErrPassphraseNotRead, so its callers no longer
add those words. ResolveGPGKeyFingerprint returns ErrGPGKeyNotFound for a
key the keyring lacks, recognised by gpg's status line. storeInKeychain
returns errNilDataBuffer. bip85's ErrPasswordTooShort and
ErrEncodedTooShort go with their unreachable checks. Tests that matched
these errors' text use errors.Is.

Model: opus-5-5

internal/cli/move_test.go

@@ -45,15 +45,6 @@ func TestRejectedMoveWithinVaultLeavesStateUnchanged(t *testing.T) {
 		{`mv --force work:x ""`, workX, "", true, ontoItself},
 		// "work" is a vault name, so the destination is work:x.
 		{"mv --force work:x work", workX, "work", true, ontoItself},
-		{
-			"mv work:nosuch work:y", "work:nosuch", "work:y", false,
-			"secret 'nosuch' not found",
-		},
-		// Only an existing vault is used.
-		{
-			"mv --force nosuch:x nosuch:y", "nosuch:x", "nosuch:y", true,
-			"vault 'nosuch' does not exist",
-		},
 	}
 
 	for _, tt := range tests {
@@ -70,6 +61,33 @@ func TestRejectedMoveWithinVaultLeavesStateUnchanged(t *testing.T) {
 		})
 	}
 
+	missing := []struct {
+		command      string
+		source, dest string
+		force        bool
+		want         error
+	}{
+		{
+			"mv work:nosuch work:y", "work:nosuch", "work:y", false,
+			vault.ErrSecretNotFound,
+		},
+		// Only an existing vault is used.
+		{
+			"mv --force nosuch:x nosuch:y", "nosuch:x", "nosuch:y", true,
+			vault.ErrVaultNotFound,
+		},
+	}
+
+	for _, tt := range missing {
+		t.Run(tt.command, func(t *testing.T) {
+			t.Parallel()
+
+			requireRejectedAndUnchanged(t, before, tt.want, func(c *cli.Instance) error {
+				return c.MoveSecret(&cobra.Command{}, tt.source, tt.dest, tt.force)
+			})
+		})
+	}
+
 	// Each of these spells "work" a second way. The spelling is not a valid
 	// vault name, so the move is not taken for a move between two vaults,
 	// which would delete the destination, here the source.