Unlock now always checks the verifier, so an empty vault can never accept a wrong master password and the 'verify against the first entry' fallback for Go/older vaults is gone. A vault without a verifier is refused with a message naming the file to remove (SEC-20261012-016). The Go vault fixture and its test go with it.