Function setup_wrapped 

pub fn setup_wrapped(
    root: impl AsRef<Path>,
    real_pin: &str,
    decoy_pin: &str,
) -> Result<String, String>

Opt-in (off by default). Create the two encrypted lanes with an OS-keychain-held pepper mixed into the KDF, so disk + PIN alone cannot open the vault. Returns the pepper as a hex recovery code: the caller MUST have the user record it out-of-band — if the keychain entry is later lost (reinstall / new machine), this code is the only way back in (see unlock_with_recovery).

Enabling this is a deliberate, recovery-aware choice; the ordinary setup path stays unwrapped.