We're now warning-free... enable -Werror for CI.

NOTE: CI does release builds, which means that -Wall is not enabled.
      WALL=1 could be added if we want that, but it's likely too
      soon to take that step.