avoid injecting code into the format string

Now that die() properly forwards arguments to error(), we can expect
that the first arg is a format string and not the entirety of the
output.

Signed-off-by: Dave Reisner <dreisner@archlinux.org>
Signed-off-by: Pierre Schmitz <pierre@archlinux.de>