ci(build): refresh PR comment live as each build job finishes

Each build job now nudges artifact-comment.yml via `gh workflow run` when
it finishes, so the PR build-status comment reflects real per-platform
progress (e.g. Android complete while iOS still building) instead of a
single stale snapshot taken when the PR was pushed.

Why this works:
- workflow_dispatch always creates a run even when triggered by the
  GITHUB_TOKEN (unlike most events), so no PAT is needed.
- No dispatch inputs are required: artifact-comment's existing
  workflow_dispatch handler resolves the PR from the dispatched ref's
  head sha (context.sha).
- artifact-comment's concurrency group is keyed by head sha for dispatch
  runs, so cancel-in-progress collapses simultaneous nudges — the comment
  can't be spammed, the latest state always wins.

The dispatch lives in a local composite action
(.github/actions/refresh-pr-comment) so the security-sensitive call sits
in one place; each build job invokes it in a single line. The action is
guarded to same-repo pull_request runs (fork tokens are read-only and
cannot dispatch), is continue-on-error so a nudge never fails a build,
and passes head_ref via an env var (never interpolated into the shell).

Adds `actions: write` to the build jobs for the dispatch call.

.github/actions/refresh-pr-comment/action.yml

@@ -0,0 +1,21 @@
+name: Refresh PR build comment
+description: >-
+  Nudge artifact-comment.yml (via workflow_dispatch) so the PR build-status
+  comment reflects live per-platform progress as each build job finishes.
+
+runs:
+  using: composite
+  steps:
+    # workflow_dispatch fires even when triggered by the GITHUB_TOKEN, and
+    # artifact-comment's concurrency group collapses simultaneous nudges, so
+    # this can't spam the comment. Skipped on forks (their read-only token
+    # cannot dispatch). github.token is used because composite actions cannot
+    # read the secrets context.
+    - if: always() && github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository
+      continue-on-error: true
+      shell: bash
+      env:
+        GH_TOKEN: ${{ github.token }}
+        HEAD_REF: ${{ github.head_ref }}
+        REPO: ${{ github.repository }}
+      run: gh workflow run artifact-comment.yml --ref "$HEAD_REF" -R "$REPO"

.github/workflows/build-apps.yml

@@ -27,6 +27,7 @@ jobs:
     name: 🤖 Build Android APK (Phone)
     permissions:
       contents: read
+      actions: write # dispatch artifact-comment.yml to refresh the PR comment
 
     steps:
       - name: 🗑️ Free Disk Space
@@ -117,12 +118,16 @@ jobs:
             android/app/build/outputs/apk/release/*.apk
           retention-days: 7
 
+      - name: 🔄 Refresh PR build comment
+        uses: ./.github/actions/refresh-pr-comment
+
   build-android-tv:
     if: (!contains(github.event.head_commit.message, '[skip ci]'))
     runs-on: ubuntu-26.04
     name: 🤖 Build Android APK (TV)
     permissions:
       contents: read
+      actions: write # dispatch artifact-comment.yml to refresh the PR comment
 
     steps:
       - name: 🗑️ Free Disk Space
@@ -212,12 +217,16 @@ jobs:
             android/app/build/outputs/apk/release/*.apk
           retention-days: 7
 
+      - name: 🔄 Refresh PR build comment
+        uses: ./.github/actions/refresh-pr-comment
+
   build-ios-phone:
     if: (!contains(github.event.head_commit.message, '[skip ci]') && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == 'streamyfin/streamyfin'))
     runs-on: macos-26
     name: 🍎 Build iOS IPA (Phone)
     permissions:
       contents: read
+      actions: write # dispatch artifact-comment.yml to refresh the PR comment
 
     steps:
       - name: 📥 Checkout code
@@ -280,12 +289,16 @@ jobs:
           path: build-*.ipa
           retention-days: 7
 
+      - name: 🔄 Refresh PR build comment
+        uses: ./.github/actions/refresh-pr-comment
+
   build-ios-phone-unsigned:
     if: (!contains(github.event.head_commit.message, '[skip ci]'))
     runs-on: macos-26
     name: 🍎 Build iOS IPA (Phone - Unsigned)
     permissions:
       contents: read
+      actions: write # dispatch artifact-comment.yml to refresh the PR comment
 
     steps:
       - name: 📥 Checkout code
@@ -339,6 +352,9 @@ jobs:
           path: build/*.ipa
           retention-days: 7
 
+      - name: 🔄 Refresh PR build comment
+        uses: ./.github/actions/refresh-pr-comment
+
   build-ios-tv:
     # Disabled: EAS has no provisioning profiles / distribution cert for the tvOS
     # targets (app + StreamyfinTopShelf extension), so non-interactive signed
@@ -349,6 +365,7 @@ jobs:
     name: 🍎 Build tvOS IPA
     permissions:
       contents: read
+      actions: write # dispatch artifact-comment.yml to refresh the PR comment
 
     steps:
       - name: 📥 Checkout code
@@ -418,6 +435,7 @@ jobs:
     name: 🍎 Build tvOS IPA (Unsigned)
     permissions:
       contents: read
+      actions: write # dispatch artifact-comment.yml to refresh the PR comment
 
     steps:
       - name: 📥 Checkout code
@@ -470,3 +488,6 @@ jobs:
           name: streamyfin-ios-tv-unsigned-ipa-${{ env.DATE_TAG }}
           path: build/*.ipa
           retention-days: 7
+
+      - name: 🔄 Refresh PR build comment
+        uses: ./.github/actions/refresh-pr-comment