v0.6.9: stop serving match-template crops as hero portraits.

Export and OSS upload require wide Heroes-page cards only; bump cache stamp to wide2 so clients drop polluted squares.

Co-authored-by: Cursor <cursoragent@cursor.com>

web/serve_relations.py

@@ -1029,16 +1029,24 @@ class Handler(BaseHTTPRequestHandler):
             else:
                 self._send(200, fpath.read_bytes(), ctype)
             return
-        if path.startswith("/portrait/") or path.startswith("/cdn/"):
-            prefix = "/portrait/" if path.startswith("/portrait/") else "/cdn/"
-            key = path[len(prefix) :]
+        if path.startswith("/portrait/"):
+            key = path[len("/portrait/") :]
             if "/" in key or "\\" in key or not key.endswith(".png"):
                 self._json(400, {"error": "bad path"})
                 return
-            # Prefer official Heroes-page cards; fall back to match templates.
+            # Wide Heroes-page cards only — never serve match templates here.
             fpath = HERO_PORTRAITS / key
             if not fpath.is_file():
-                fpath = TEMPLATES_CDN / key
+                self.send_error(404)
+                return
+            self._send(200, fpath.read_bytes(), "image/png")
+            return
+        if path.startswith("/cdn/"):
+            key = path[len("/cdn/") :]
+            if "/" in key or "\\" in key or not key.endswith(".png"):
+                self._json(400, {"error": "bad path"})
+                return
+            fpath = TEMPLATES_CDN / key
             if not fpath.is_file():
                 self.send_error(404)
                 return