Give each failure one error value (closes #113)

internal/cli's copies of vault.ErrSecretNotFound, ErrVaultNotFound,
ErrVersionNotFound and ErrSecretExists are removed; the commands wrap the
vault errors. errUnsupportedUnlockerType is removed for
errInvalidUnlockerType, which names the same failure. Every error of
secret.ReadPassphrase wraps ErrPassphraseNotRead, so its callers no longer
add those words. ResolveGPGKeyFingerprint returns ErrGPGKeyNotFound for a
key the keyring lacks, recognised by gpg's status line. storeInKeychain
returns errNilDataBuffer. bip85's ErrPasswordTooShort and
ErrEncodedTooShort go with their unreachable checks. Tests that matched
these errors' text use errors.Is.

Model: opus-5-5

internal/cli/unlockers.go

@@ -47,7 +47,6 @@ var (
 	// composes "GPG key <id> is already added as an unlocker".
 	errGPGKeyAlreadyUnlocker = errors.New(
 		"is already added as an unlocker")
-	errUnsupportedUnlockerType = errors.New("unsupported unlocker type")
 )
 
 // UnlockerInfo represents unlocker information for display
@@ -439,7 +438,7 @@ func (cli *Instance) UnlockersAdd(unlockerType string, cmd *cobra.Command) error
 		}
 
 		return fmt.Errorf("%w: %s (supported: %s)",
-			errUnsupportedUnlockerType, unlockerType, supportedTypes)
+			errInvalidUnlockerType, unlockerType, supportedTypes)
 	}
 }
 
@@ -474,7 +473,7 @@ func (cli *Instance) addPassphraseUnlocker(cmd *cobra.Command) error {
 		// Use secure passphrase input with confirmation
 		passphraseBuffer, err = readSecurePassphrase("Enter passphrase for unlocker: ")
 		if err != nil {
-			return fmt.Errorf("failed to read passphrase: %w", err)
+			return err
 		}
 		defer passphraseBuffer.Destroy()
 	}