Map s3 not-found to storage.ErrNotFound in Get and Stat (closes #129)

S3Storer.Get and Stat returned the raw AWS SDK error for a missing
object, so errors.Is(err, storage.ErrNotFound) was false on the s3
backend while the file and rclone backends honored the Storer contract.
Callers that branch on ErrNotFound behaved differently per backend.

Both now wrap ErrNotFound when the SDK reports a missing object,
leaving every other error intact. The not-found detection is a small
exported s3.IsNotFound helper, also used by HeadObject so the two share
one definition. A test asserts a missing key maps to ErrNotFound on the
s3 backend; it fails without the mapping.

model: claude-opus-4-8

TODO.md

@@ -25,6 +25,15 @@ release" is exactly the contradiction
 
 # Completed Steps
 
+- 2026-09-21: Made the s3 storage backend report a missing object as
+  `storage.ErrNotFound`, like the `file` and `rclone` backends and as the
+  `Storer` interface documents. `S3Storer.Get` and `Stat` returned the raw
+  AWS SDK error, so `errors.Is(err, storage.ErrNotFound)` was false on s3
+  and callers branched differently per backend. Added a small `s3.IsNotFound`
+  helper (reused by `HeadObject`) and a test that a missing key maps to
+  `ErrNotFound`
+  ([issue #129](https://git.eeqj.de/sneak/vaultik/issues/129)).
+
 - 2026-09-21: Fixed `verify --deep` reporting healthy snapshots as
   corrupt. Its final blob-integrity check hashed the encrypted
   downloaded bytes with a single SHA256 and compared that to the blob