licence,ci: ship OFL with Plex fonts and guard release dispatch (P5)

IBM Plex WOFF2 files were shipped without the SIL OFL 1.1 text, NOTICE
told modifiers to edit layout.html for a Source URL that lives in
legal.go, and workflow_dispatch took GITHUB_REF_NAME as the version so a
run from main would publish ghcr.io/...:main.

Closes P5 of docs/plans/code-review.md. CHANGELOG updated.

Co-Authored-By: Cursor Grok 4.6 <noreply@anthropic.com>
Co-authored-by: Cursor <cursoragent@cursor.com>

docs/roadmap.md

@@ -59,6 +59,9 @@ Not inbound-relay, not DMARC ingestion, not a layer rewrite.
 **Done when:** see the criteria in
 [plans/code-review.md](plans/code-review.md).
 
+**Progress:** P0–P5 done. Remaining: P6 (optional cleanup), P7 (Fable review
+of the P0–P1 diff).
+
 **Dependencies / risks:** P0 is confidentiality between panel roles; it
 jumps the feature queue. Implementation models are in the plan (Opus / Sonnet
 / Haiku / Fable per [development.md](development.md)).