Build clean under -Wall, with -Werror in CI only

TODO.md item 37 said the cast sweep buys nothing until the build turns on the
warnings those casts suppress. This is that precondition, and the argument
turned out to be right with evidence: -Wall found three genuine signedness
mismatches in sprite.c, where uint32_t width, height and speed were passed
straight to akgl_get_json_integer_value(..., int *). A cast would have silenced
all three. Fixing them properly also turned up that speed is scaled by a million
into a 32-bit field, so anything past 4294 ms overflowed rather than being held.

The other real finding was ten -Wstringop-truncation warnings, every one a
fixed-width strncpy. Those leave a name field unterminated when the input fills
it -- and those fields are registry keys, handed to strcmp and SDL property
calls that do not stop at the field. Same overread class fixed twice already
this release. All ten now use aksl_strncpy from akstdlib, which always
terminates and never NUL-pads, bounded to size - 1 so an over-long name still
truncates rather than being refused. staticstring.h documented the old strncpy
semantics explicitly and has been rewritten to match.

Two sites in game.c are deliberately left on strncpy: both stage into a
pre-zeroed buffer for the savegame's fixed-width fields, where the NUL padding
is part of the format. Neither is flagged.

sprite.c also had a memcpy of a full 128-byte field from a NUL-terminated
string, which reads past the end of any shorter name. Not flagged by anything;
found while converting its neighbours.

-Werror is an option, default OFF, on only in the cmake_build and performance CI
jobs. libakgl is consumed with add_subdirectory -- akbasic does exactly that --
so a target-level -Werror turns every diagnostic a newer compiler invents into a
broken build for somebody else. The warning set is not even stable across build
types here: an -O2 build reports ten warnings that -O0 and -fsyntax-only do not,
because they need the middle end. The two jobs that set it are one of each.

-Wextra is deliberately not adopted. It adds 22 findings, 17 inherent to the
design: 13 -Wunused-parameter from backend vtables and SDL callbacks that must
match a signature, and 4 -Wimplicit-fallthrough from libakerror's own
PROCESS/HANDLE/HANDLE_GROUP, which fall through by design. Filed upstream as
deps/libakerror TODO item 8; the submodule bump carries it.

deps/semver/semver.c is listed directly in add_library, so the target's PRIVATE
options reach it. Exempted with -w so a future semver update cannot fail this
build -- verified by forcing -Wextra -Werror and watching our files fail while
semver compiled clean.

Verified: RelWithDebInfo, Debug and coverage builds all clean under -Werror;
-Werror actually fails on a planted unused variable; an embedded consumer with
AKGL_WERROR unset still configures and builds. 25/25 pass, memcheck clean,
reindent --check, check_api_surface and check_error_protocol clean.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

CMakeLists.txt

@@ -38,6 +38,32 @@ endif()
 include(CTest)
 option(AKGL_COVERAGE "Instrument libakgl and generate coverage reports with CTest" OFF)
 
+# -Wall is always on for code this project owns. -Werror is not, and the
+# distinction is deliberate.
+#
+# libakgl is consumed with add_subdirectory() -- akbasic does exactly that -- so
+# a target-level -Werror makes every new compiler diagnostic a broken build for
+# somebody else's project. The warning set is not even stable across build types
+# here: an -O2 build reports ten -Wstringop-truncation warnings that -O0 and
+# -fsyntax-only do not, because they need the middle end. A newer GCC or a
+# switch to clang moves the line again.
+#
+# So the errors live in CI, where the compiler is pinned and a new warning is a
+# task for the maintainer rather than an outage for a consumer.
+option(AKGL_WERROR "Treat compiler warnings as errors. For CI; leave OFF when embedding." OFF)
+set(AKGL_WARNING_FLAGS -Wall)
+if(AKGL_WERROR)
+  list(APPEND AKGL_WARNING_FLAGS -Werror)
+endif()
+
+# -Wextra is deliberately not here. It adds 22 findings, 17 of which are
+# inherent to the design rather than defects: 13 -Wunused-parameter, because a
+# backend vtable entry or an SDL callback has to match a signature whether it
+# reads every argument or not, and 4 -Wimplicit-fallthrough from libakerror's
+# own PROCESS/HANDLE/HANDLE_GROUP, which fall through between case labels by
+# design. Adopting it would mean disabling both permanently to gain 5
+# -Wsign-compare. See deps/libakerror/TODO.md item 8.
+
 if(AKGL_COVERAGE)
   if(NOT CMAKE_C_COMPILER_ID MATCHES "GNU|Clang")
     message(FATAL_ERROR "AKGL_COVERAGE requires GCC or Clang")
@@ -261,6 +287,13 @@ set_target_properties(akgl PROPERTIES
   SOVERSION ${AKGL_SOVERSION}
 )
 
+target_compile_options(akgl PRIVATE ${AKGL_WARNING_FLAGS})
+# deps/semver/semver.c is vendored and listed directly in add_library(), so the
+# target's PRIVATE options reach it. Exempt it: a future semver update must not
+# be able to fail this build. (PRIVATE options do not reach SDL, jansson,
+# akerror or akstdlib -- those are separate targets.)
+set_source_files_properties(deps/semver/semver.c PROPERTIES COMPILE_OPTIONS "-w")
+
 add_library(akgl::akgl ALIAS akgl)
 
 add_executable(charviewer util/charviewer.c)
@@ -475,9 +508,11 @@ target_link_libraries(akgl
 foreach(suite IN LISTS AKGL_TEST_SUITES AKGL_PERF_SUITES)
   target_link_libraries(akgl_test_${suite} PRIVATE akstdlib::akstdlib akerror::akerror akgl SDL3::SDL3 SDL3_ttf::SDL3_ttf SDL3_image::SDL3_image SDL3_mixer::SDL3_mixer  jansson::jansson -lm)
   target_include_directories(akgl_test_${suite} PRIVATE "${CMAKE_CURRENT_SOURCE_DIR}/tests")
+  target_compile_options(akgl_test_${suite} PRIVATE ${AKGL_WARNING_FLAGS})
 endforeach()
 
 target_link_libraries(charviewer PRIVATE akstdlib::akstdlib akerror::akerror akgl SDL3::SDL3 SDL3_ttf::SDL3_ttf SDL3_image::SDL3_image SDL3_mixer::SDL3_mixer  jansson::jansson -lm)
+target_compile_options(charviewer PRIVATE ${AKGL_WARNING_FLAGS})
 
 # When the vendored SDL satellite libraries are built in-tree they land in per-
 # project subdirectories that are not on the loader's default search path, so a