.github/workflows: Configure warnings-as-errors policy

Enable WERROR=y for CI and package builds so warnings in SCST code
are fatal.

Keep WERROR=n for regression and Coverity because these workflows
must tolerate failures outside strict SCST package gates.

.github/workflows/ci.yml

@@ -2,6 +2,9 @@ name: CI
 
 on: [push, pull_request]
 
+env:
+  WERROR: 'y'
+
 jobs:
   build:
     runs-on: ubuntu-latest
@@ -22,6 +25,6 @@ jobs:
       - name: Build
         env:
           CC: ${{ matrix.compiler }}
-          CFLAGS: -Werror ${{ matrix.arch == 'x86' && '-m32' || '' }}
+          CFLAGS: ${{ matrix.arch == 'x86' && '-m32' || '' }}
           LDFLAGS: ${{ matrix.arch == 'x86' && '-m32' || '' }}
         run: make CC=${{matrix.compiler}} dpkg