fix(core): zeroize keyfile_encode output + lock-in tests for backup-keyfile-error and malformed-vs-wrong unlock

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01McMF5pUJbCMricmFEnf2sG

crates/relicario-cli/src/commands/init.rs

@@ -56,7 +56,8 @@ pub fn cmd_init(image: Option<PathBuf>, output: PathBuf, key_file: Option<PathBu
             // the server would hold both the ciphertext and the key, defeating
             // the two-factor model.
             let kf_path = root.join(kf);
-            fs::write(&kf_path, relicario_core::keyfile::keyfile_encode(&secret))
+            let armored = relicario_core::keyfile::keyfile_encode(&secret);
+            fs::write(&kf_path, armored.as_slice())
                 .with_context(|| format!("failed to write key file {}", kf_path.display()))?;
             let name = kf
                 .file_name()