fix: refuse vaults without a verifier

Unlock now always checks the verifier, so an empty vault can never
accept a wrong master password and the 'verify against the first entry'
fallback for Go/older vaults is gone. A vault without a verifier is
refused with a message naming the file to remove (SEC-20261012-016).
The Go vault fixture and its test go with it.

rust/core/tests/fixtures/README.md

@@ -5,7 +5,6 @@ Generated by the last Go build of Alchementary Link with `cmd/genfixtures` (see
 
 - `link.db` — a database through migration 006 with every protocol, a known host, a snippet,
   IRC channel state and preferences.
-- `vault/vault.json` — a vault whose master password is `correct horse battery staple`.
 - `profiles.link` — an encrypted export with password `export-pass`.
 - `recordings/rec1.cast` — an asciicast v2 recording.