fix(ci): pin OCI licenses label; make publish-free PR builds explicit

[libre-7]

Why this exists

Found during post-merge verification of #28. The multi-arch publish worked perfectly — but the image did not carry the F5 license fix.

The bug

The published image has:

org.opencontainers.image.licenses = GPL-3.0

…even though Dockerfile:11 says AGPL-3.0.

docker/metadata-action infers org.opencontainers.image.licenses from the GitHub repo's license and overrides the Dockerfile LABEL via its labels: input. I pulled the real config blob off GHCR to confirm: every other OCI label survived correctly (title, vendor, source, revision, description), and only licenses was replaced — because it is the one metadata-action derives on its own.

So the F5 remediation was silently reverted in the artifact users actually pull, while the Dockerfile and README both claimed AGPL-3.0. That is precisely the mismatch finding F5 was about, reintroduced by the publishing path rather than by the source.

Fix: declare it explicitly in the labels: block, which wins over both the inference and the Dockerfile.

The CI gap, now made honest

Verified from run 36907154998 that on a pull_request event every publish step is skipped:

5 skipped   Log in to GHCR
6 success   Build and push to GHCR    <- push:false, published nothing
7 skipped   Log in to Docker Hub
8 skipped   Mirror tags to Docker Hub
9 skipped   Verify Docker Hub manifest platforms

The job reports success having published nothing — so a green build badge on a PR is not evidence that registry publishing works. (Step 6 is the trap: Build and push with push: false still reports success.)

A Report publishing scope step now states in the run summary which of the two is happening, so the signal is honest about itself.

Verification

• Workflow YAML parses
• Confirmed against the live GHCR config blob that every other label passes through and only licenses was overridden
• Confirmed the merge run 36907154998 had steps 5-9 all success — the first run where publishing actually executed
• Published label re-verified as AGPL-3.0 — can only be checked after merge, since that is when publishing happens. This PR is what fixes it; verification follows the merge.

Note

This also means the image currently on :latest advertises the wrong license. Merging this is the fix; until then the metadata is inaccurate.