ci(build): refresh PR comment live as each build job finishes

Each build job now nudges artifact-comment.yml via `gh workflow run` when
it finishes, so the PR build-status comment reflects real per-platform
progress (e.g. Android complete while iOS still building) instead of a
single stale snapshot taken when the PR was pushed.

Why this works:
- workflow_dispatch always creates a run even when triggered by the
  GITHUB_TOKEN (unlike most events), so no PAT is needed.
- No dispatch inputs are required: artifact-comment's existing
  workflow_dispatch handler resolves the PR from the dispatched ref's
  head sha (context.sha).
- artifact-comment's concurrency group is keyed by head sha for dispatch
  runs, so cancel-in-progress collapses simultaneous nudges — the comment
  can't be spammed, the latest state always wins.

The dispatch lives in a local composite action
(.github/actions/refresh-pr-comment) so the security-sensitive call sits
in one place; each build job invokes it in a single line. The action is
guarded to same-repo pull_request runs (fork tokens are read-only and
cannot dispatch), is continue-on-error so a nudge never fails a build,
and passes head_ref via an env var (never interpolated into the shell).

Adds `actions: write` to the build jobs for the dispatch call.

.github/workflows/build-apps.yml

@@ -27,6 +27,7 @@ jobs:
     name: 🤖 Build Android APK (Phone)
     permissions:
       contents: read
+      actions: write # dispatch artifact-comment.yml to refresh the PR comment
 
     steps:
       - name: 🗑️ Free Disk Space
@@ -117,12 +118,16 @@ jobs:
             android/app/build/outputs/apk/release/*.apk
           retention-days: 7
 
+      - name: 🔄 Refresh PR build comment
+        uses: ./.github/actions/refresh-pr-comment
+
   build-android-tv:
     if: (!contains(github.event.head_commit.message, '[skip ci]'))
     runs-on: ubuntu-26.04
     name: 🤖 Build Android APK (TV)
     permissions:
       contents: read
+      actions: write # dispatch artifact-comment.yml to refresh the PR comment
 
     steps:
       - name: 🗑️ Free Disk Space
@@ -212,12 +217,16 @@ jobs:
             android/app/build/outputs/apk/release/*.apk
           retention-days: 7
 
+      - name: 🔄 Refresh PR build comment
+        uses: ./.github/actions/refresh-pr-comment
+
   build-ios-phone:
     if: (!contains(github.event.head_commit.message, '[skip ci]') && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == 'streamyfin/streamyfin'))
     runs-on: macos-26
     name: 🍎 Build iOS IPA (Phone)
     permissions:
       contents: read
+      actions: write # dispatch artifact-comment.yml to refresh the PR comment
 
     steps:
       - name: 📥 Checkout code
@@ -280,12 +289,16 @@ jobs:
           path: build-*.ipa
           retention-days: 7
 
+      - name: 🔄 Refresh PR build comment
+        uses: ./.github/actions/refresh-pr-comment
+
   build-ios-phone-unsigned:
     if: (!contains(github.event.head_commit.message, '[skip ci]'))
     runs-on: macos-26
     name: 🍎 Build iOS IPA (Phone - Unsigned)
     permissions:
       contents: read
+      actions: write # dispatch artifact-comment.yml to refresh the PR comment
 
     steps:
       - name: 📥 Checkout code
@@ -339,6 +352,9 @@ jobs:
           path: build/*.ipa
           retention-days: 7
 
+      - name: 🔄 Refresh PR build comment
+        uses: ./.github/actions/refresh-pr-comment
+
   build-ios-tv:
     # Disabled: EAS has no provisioning profiles / distribution cert for the tvOS
     # targets (app + StreamyfinTopShelf extension), so non-interactive signed
@@ -349,6 +365,7 @@ jobs:
     name: 🍎 Build tvOS IPA
     permissions:
       contents: read
+      actions: write # dispatch artifact-comment.yml to refresh the PR comment
 
     steps:
       - name: 📥 Checkout code
@@ -418,6 +435,7 @@ jobs:
     name: 🍎 Build tvOS IPA (Unsigned)
     permissions:
       contents: read
+      actions: write # dispatch artifact-comment.yml to refresh the PR comment
 
     steps:
       - name: 📥 Checkout code
@@ -470,3 +488,6 @@ jobs:
           name: streamyfin-ios-tv-unsigned-ipa-${{ env.DATE_TAG }}
           path: build/*.ipa
           retention-days: 7
+
+      - name: 🔄 Refresh PR build comment
+        uses: ./.github/actions/refresh-pr-comment