licence,ci: ship OFL with Plex fonts and guard release dispatch (P5)

IBM Plex WOFF2 files were shipped without the SIL OFL 1.1 text, NOTICE
told modifiers to edit layout.html for a Source URL that lives in
legal.go, and workflow_dispatch took GITHUB_REF_NAME as the version so a
run from main would publish ghcr.io/...:main.

Closes P5 of docs/plans/code-review.md. CHANGELOG updated.

Co-Authored-By: Cursor Grok 4.6 <noreply@anthropic.com>
Co-authored-by: Cursor <cursoragent@cursor.com>

NOTICE

@@ -10,8 +10,8 @@ Corresponding Source for the published releases is at:
 
 If you modify SelfPost and let users interact with it over a network,
 AGPL-3.0 §13 requires you to offer them the Corresponding Source of
-your modified version. Update the Source link in the panel footer
-(internal/web/view/templates/layout.html) so it points at your sources.
+your modified version. Update SourceURL in internal/legal/legal.go
+so the panel footer points at your sources.
 
 Third-party software included in this distribution
 ----------------------------------------------------
@@ -24,6 +24,9 @@ htmx 2.0.4 (internal/web/view/static/htmx.min.js)
 IBM Plex Sans / IBM Plex Mono
   Copyright © 2017 IBM Corp., with Reserved Font Name "Plex"
   Licence: SIL Open Font License 1.1
+  Full text: internal/web/view/static/OFL.txt
+    (also /usr/share/doc/selfpost/OFL.txt in the image, and
+    /static/OFL.txt from the control panel)
   https://github.com/IBM/plex
   Distributed unmodified as three latin-subset WOFF2 files served by the
   control panel: