feat: T1016 dns_config probe + server-side drift detection + Crucible DNS DRIFT badge

server/internal/db/sqlite.go

@@ -307,7 +307,8 @@ func (d *Database) GetLatestBuildForPlatform(platform string) (*models.BuildReco
 }
 
 // SetPinnedBuild unpins all builds then pins the one with the given id.
-// If id is empty, all builds are unpinned.
+// If id is empty, all builds are unpinned. Returns an error when id is
+// non-empty but no build row matches (avoids leaving all builds unpinned).
 func (d *Database) SetPinnedBuild(id string) error {
 	_, err := d.Exec(`UPDATE builds SET pinned = 0`)
 	if err != nil {
@@ -316,8 +317,18 @@ func (d *Database) SetPinnedBuild(id string) error {
 	if id == "" {
 		return nil
 	}
-	_, err = d.Exec(`UPDATE builds SET pinned = 1 WHERE id = ?`, id)
-	return err
+	res, err := d.Exec(`UPDATE builds SET pinned = 1 WHERE id = ?`, id)
+	if err != nil {
+		return err
+	}
+	n, err := res.RowsAffected()
+	if err != nil {
+		return err
+	}
+	if n == 0 {
+		return fmt.Errorf("build not found: %s", id)
+	}
+	return nil
 }
 
 func (d *Database) ListBuilds(limit int) ([]*models.BuildRecord, error) {