licence,ci: ship OFL with Plex fonts and guard release dispatch (P5)

IBM Plex WOFF2 files were shipped without the SIL OFL 1.1 text, NOTICE
told modifiers to edit layout.html for a Source URL that lives in
legal.go, and workflow_dispatch took GITHUB_REF_NAME as the version so a
run from main would publish ghcr.io/...:main.

Closes P5 of docs/plans/code-review.md. CHANGELOG updated.

Co-Authored-By: Cursor Grok 4.6 <noreply@anthropic.com>
Co-authored-by: Cursor <cursoragent@cursor.com>

docs/plans/code-review.md

@@ -594,13 +594,18 @@ the override.
 **Model: Sonnet** for OFL/NOTICE prose; **Opus** for `release.yml`; **Haiku**
 for SPDX consistency and deleting the done logrotate plan.
 
-- [ ] Add SIL OFL 1.1 text beside the Plex WOFF2 files; point `NOTICE` at it.
-- [ ] `NOTICE` Source URL instructions → `internal/legal/legal.go`.
-- [ ] `release.yml`: `workflow_dispatch` must not publish `main` as a version
+- [x] Add SIL OFL 1.1 text beside the Plex WOFF2 files; point `NOTICE` at it.
+      IBM Plex `LICENSE.txt` as `internal/web/view/static/OFL.txt` (copyright
+      + OFL 1.1). Copied into the image at `/usr/share/doc/selfpost/OFL.txt`;
+      served at `/static/OFL.txt`.
+- [x] `NOTICE` Source URL instructions → `internal/legal/legal.go`.
+- [x] `release.yml`: `workflow_dispatch` must not publish `main` as a version
       (require `vX.Y.Z` or an explicit `version` input that matches SemVer).
-- [ ] Delete [plans/logrotate-mode.md](logrotate-mode.md) (done; git keeps it).
-- [ ] Decide SPDX-everywhere vs SPDX-nowhere; do not leave two files special
-      without a one-line note in development.md.
+- [x] Delete [plans/logrotate-mode.md](logrotate-mode.md) (done; git keeps it).
+- [x] Decide SPDX-everywhere vs SPDX-nowhere; do not leave two files special
+      without a one-line note in development.md. SPDX-nowhere: dropped the
+      two `cmd/` headers; development.md § External libraries records that
+      AGPL-3.0 does not require per-file SPDX.
 
 **Done when:** OFL travels with the fonts; a dispatch from `main` cannot tag
 `ghcr.io/...:main`.

docs/plans/logrotate-mode.md

@@ -1,28 +0,0 @@
-# Plan: logrotate-mode (mail.log stops rotating in some images)
-
-**Status:** done  
-**Version:** patch; no schema, no configuration surface.
-
----
-
-## Summary
-
-`mail.log` stopped rotating when `/etc/logrotate.d/mail` landed in the image
-with group/other write permission (e.g. build context from a Windows tar sync).
-logrotate ignores such configs but exits 0, so the loop looked healthy while
-the log grew without bound.
-
-## What shipped
-
-- [`build/Dockerfile`](../../build/Dockerfile): `COPY --chmod` pins config
-  (`0644`) and script (`0755`) modes so the image no longer depends on checkout
-  file modes.
-- [`build/logrotate-loop.sh`](../../build/logrotate-loop.sh): preflight and
-  per-iteration checks refuse group/other-writable configs; logrotate stderr
-  mentioning `Ignoring` is fatal.
-- [`test/e2e/logrotate_check.go`](../../test/e2e/logrotate_check.go): asserts
-  mode `644`, forced `logrotate -f`, and that a group-writable context file
-  still produces `644` in the image.
-
-`create 0640 postfix selfpost` in [`build/logrotate-mail.conf`](../../build/logrotate-mail.conf)
-is unchanged — required for panel readability after rotation.