licence,ci: ship OFL with Plex fonts and guard release dispatch (P5)

IBM Plex WOFF2 files were shipped without the SIL OFL 1.1 text, NOTICE
told modifiers to edit layout.html for a Source URL that lives in
legal.go, and workflow_dispatch took GITHUB_REF_NAME as the version so a
run from main would publish ghcr.io/...:main.

Closes P5 of docs/plans/code-review.md. CHANGELOG updated.

Co-Authored-By: Cursor Grok 4.6 <noreply@anthropic.com>
Co-authored-by: Cursor <cursoragent@cursor.com>

test/e2e/logrotate_check.go

@@ -10,7 +10,8 @@ import (
 )
 
 // checkLogrotateConfigMode verifies the image pins /etc/logrotate.d/mail at 0644
-// so logrotate will not silently ignore it (docs/plans/logrotate-mode.md).
+// so logrotate will not silently ignore it (docs/development.md § Building
+// binaries and the image).
 func checkLogrotateConfigMode(s *stack) error {
 	mode, err := s.execIn("selfpost", "stat", "-c", "%a", "/etc/logrotate.d/mail")
 	if err != nil {