fix: resolve check-safety Go lint failures in ninja bnp

- build.go: lowercase the capitalized error string (staticcheck ST1005)
- verify.go: rewrite range-over-strings.Split loop as slices.Contains,
  breaking a Go 1.26 `go fix` stringsseq/slicescontains conflict loop
- driver_test.go: check deferred db.Close() error (errcheck)
- dbvalue.go: reflect.TypeOf -> reflect.TypeFor (applied by golangci --fix)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

cmd/ninja/internal/bnp/build.go

@@ -215,7 +215,7 @@ func checkGoVersion(ctx context.Context) error {
 	minor, _ := strconv.Atoi(m[2])
 	if major < minGoMajor || (major == minGoMajor && minor < minGoMinor) {
 		return fmt.Errorf(
-			"Go %d.%d+ is required to build reactor-mode wasip1 plugins; found %d.%d — upgrade your toolchain",
+			"building reactor-mode wasip1 plugins requires Go %d.%d+; found %d.%d — upgrade your toolchain",
 			minGoMajor, minGoMinor, major, minor)
 	}
 	return nil

cmd/ninja/internal/bnp/verify.go

@@ -9,6 +9,7 @@ import (
 	"io"
 	"os"
 	"path/filepath"
+	"slices"
 	"strings"
 
 	abiv1 "git.dev.alexdunmow.com/block/core/abi/v1"
@@ -216,10 +217,8 @@ func safeJoin(root, name string) (string, error) {
 	if filepath.IsAbs(name) || strings.HasPrefix(norm, "/") {
 		return "", fmt.Errorf("bnp: absolute entry path %q rejected", name)
 	}
-	for _, seg := range strings.Split(norm, "/") {
+	if slices.Contains(strings.Split(norm, "/"), "..") {
-		if seg == ".." {
+		return "", fmt.Errorf("bnp: entry %q contains a traversal segment", name)
-			return "", fmt.Errorf("bnp: entry %q contains a traversal segment", name)
-		}
 	}
 	target := filepath.Join(root, filepath.Clean(norm))
 	rel, err := filepath.Rel(root, target)

plugin/wasmguest/bnwasm/dbvalue.go

@@ -179,7 +179,7 @@ func naturalValue(dv *abiv1.DbValue) (any, bool) {
 
 // uuidSliceType is the reflect.Type of []uuid.UUID, the canonical scan
 // destination sqlc emits for a uuid[] column (and COALESCE(...::uuid[]) arg).
-var uuidSliceType = reflect.TypeOf([]uuid.UUID(nil))
+var uuidSliceType = reflect.TypeFor[[]uuid.UUID]()
 
 // scanValue assigns a DbValue into a destination pointer with pgx-flavored Scan
 // semantics: a nil dest skips the column; a sql.Scanner destination is fed the

plugin/wasmguest/bnwasm/driver_test.go

@@ -280,7 +280,7 @@ func TestDatabaseSQLDriverRegistered(t *testing.T) {
 		&abiv1.DbValue{Kind: &abiv1.DbValue_StringValue{StringValue: "alice"}},
 	)}
 	db := sql.OpenDB(NewConnector(host.call))
-	defer db.Close()
+	defer func() { _ = db.Close() }()
 
 	var id int
 	var name string