ci(publish): add a -fonts release flavor with the spoofed OS font bundles kept

[emandel2630]

Summary

Every release is currently published without the spoofed Windows/macOS font bundles: CAMOUFOX_KEEP_SPOOFED_OS_FONTS (#101, #108) defaults to 0 and none of the publish workflows set it. Since FINGERPRINT_POOL hands each browser a Windows or macOS profile and Camoufox spoofs that OS's font list, a screenshot (#106) from the published image renders as tofu for anything but a Linux fingerprint — the only fix today is a local build.

This adds a second flavor to publish.yml so each v* push also produces :X.Y.Z-fonts and :latest-fonts, built from the same apps/api/Dockerfile with the arg set.

What changes

• build matrix gains a flavor: [default, fonts] axis; the build arg, cache scope and digest artifact name are keyed by it.
• merge runs once per flavor. The fonts run uses docker/metadata-action's suffix=-fonts,onlatest=true, so the default :X.Y.Z / :latest tags are produced exactly as before and the fonts build can never shadow them.
• README image table, the standalone deployment note and the changelog mention the new tag.

Nightlies and the baseline image are untouched. Cost is one extra build per platform on release pushes only, and the -fonts image is ~891 MB larger, as documented for the arg.

Verification

• Workflow parses; the matrix expands to 4 build jobs and 2 merge jobs.
• I cannot run the release workflow from a fork. If you would rather see it exercised first, a workflow_dispatch trigger on a throwaway tag would confirm the tag set before the next release.