Golden vectors pin the KDF, the page-authentication key derivation and the
exact on-disk bytes of a page under a fixed IV, so a refactor cannot silently
change the format.
The vectors alone would only pin this port to itself, so both are
cross-verified against libsqlcipher 4.5.6 by decrypting databases the C
library actually wrote:
testdata/c-4.5.6.db raw key (x'HEX'), 7 pages, overflow +
index + random and zero blobs
testdata/c-4.5.6-passphrase.db passphrase, proving PBKDF2-HMAC-SHA512 at
256000 iterations agrees byte for byte
Fail-closed is asserted, not assumed: wrong key, wrong salt, wrong
passphrase, a flipped ciphertext/IV/tag bit, and a page replayed at another
page number all return ErrKey with no data.
Note the reserve trailer carries the IV and is fresh on every write, so a
round-trip is the identity on the usable bytes, not on the trailer.
