As mentioned in Scott's answer, since this is open source hardware, you have to make any changes to their files available also.
Re the firmware, you don't have to make any of the source code available, so your IP (intellectual property) is covered their. You do have to make your object files available in case someone wanted to burn their own chip using an updated version of the Arduino core and libraries. Very unlikely but that's what the license says.
Yes, you can have the PCB manufacturer program the chip. The programming can be done after the ATmega has been soldered on the board as long as you include a 2x3 pin header for ISP (In System Programming) to your board.
Make sure the entire image is programmed onto the chip, including both the bootloader and your application code. This will allow you to update your application code in the future if needed. So make sure you include the necessary interface so you can connect up the Arduino IDE to your board for updating the app.
If you will be programming the ATmegas before putting them on the board, with both the bootloader and application code, using some sort of jig, then you could omit the ISP header but there is the possibility the board could become "bricked" in the future and you would not be able to update it using the IDE. So I suggest keeping the header, unless there isn't room for it. Cost weise, its ony a few cents.