test: pass the recipient protected header to Unwrap (#5)

The CEK-recovery helper still called ecdhkw.Unwrap with the old
two-argument signature, breaking the build. Feed it the recipient's
protected header bytes, the same way unwrapper.go does.


Assisted-by: Claude:claude-opus-5[1m]

Signed-off-by: Miroslav Bajtoš <oss@bajtos.net>

Author: bajtos

fee_test.go

@@ -205,10 +205,13 @@ func encryptAndRecoverCEK(t *testing.T, key *ecdh.PrivateKey, plaintext []byte)
 	ephPub, err := ecdh.X25519().NewPublicKey(x)
 	require.NoError(t, err)
 
+	protected, err := rcpt.Headers.ProtectedBytes()
+	require.NoError(t, err)
+
 	cek, err = ecdhkw.Unwrap(key, &ecdhkw.Wrapped{
 		EphemeralPublicKey: ephPub,
 		WrappedCEK:         rcpt.Ciphertext,
-	})
+	}, protected)
 	require.NoError(t, err, "ECDH-ES+A256KW unwrap")
 
 	return blob, cek, baseNonce