transaction: Return errors wrapping pam.Error values on failure

If the transaction fails during start, there's no way to get the error
detail in a programmatic way, so let's wrap the pam.Error to allow more
per-type checks.

transaction.go

@@ -22,7 +22,7 @@ package pam
 import "C"
 
 import (
-	"errors"
+	"fmt"
 	"runtime"
 	"runtime/cgo"
 	"strings"
@@ -164,7 +164,9 @@ func StartFunc(service, user string, handler func(Style, string) (string, error)
 // transaction provides an interface to the remainder of the API.
 func StartConfDir(service, user string, handler ConversationHandler, confDir string) (*Transaction, error) {
 	if !CheckPamHasStartConfdir() {
-		return nil, errors.New("StartConfDir() was used, but the pam version on the system is not recent enough")
+		return nil, fmt.Errorf(
+			"%w: StartConfDir was used, but the pam version on the system is not recent enough",
+			ErrSystem)
 	}
 
 	return start(service, user, handler, confDir)
@@ -174,7 +176,8 @@ func start(service, user string, handler ConversationHandler, confDir string) (*
 	switch handler.(type) {
 	case BinaryConversationHandler:
 		if !CheckPamHasBinaryProtocol() {
-			return nil, errors.New("BinaryConversationHandler() was used, but it is not supported by this platform")
+			return nil, fmt.Errorf("%w: BinaryConversationHandler was used, but it is not supported by this platform",
+				ErrSystem)
 		}
 	}
 	t := &Transaction{
@@ -198,7 +201,7 @@ func start(service, user string, handler ConversationHandler, confDir string) (*
 		t.status = C.pam_start_confdir(s, u, t.conv, c, &t.handle)
 	}
 	if t.status != success {
-		return nil, t
+		return nil, Error(t.status)
 	}
 	return t, nil
 }