fix(#322): use PR head SHA in artifact names, not the merge SHA

Gemini adversarial review caught a real traceability defect.

On a `pull_request` event, `github.sha` evaluates to the last merge
commit of `refs/pull/N/merge`, not the PR head commit. That merge
commit is ephemeral and is not present in branch history, so a PR
artifact named with it cannot be traced back to any real commit,
which defeats the acceptance criterion this change was written to
satisfy.

Verified against GitHub's events-that-trigger-workflows reference:
"Note that GITHUB_SHA for this event is the last merge commit of the
pull request merge branch."

Now uses `github.event.pull_request.head.sha || github.sha`, which
resolves to the PR head on pull_request events and falls back to the
push SHA on pushes to dev/main.

Part of epic #312, plan #321 (Phase 1).

.github/workflows/build.yml

@@ -34,7 +34,7 @@ jobs:
       - name: Upload APK
         uses: actions/upload-artifact@v4
         with:
-          name: offband-android-r${{ github.run_number }}-${{ github.sha }}
+          name: offband-android-r${{ github.run_number }}-${{ github.event.pull_request.head.sha || github.sha }}
           path: build/app/outputs/flutter-apk/app-release.apk
           if-no-files-found: error
           retention-days: 14
@@ -65,7 +65,7 @@ jobs:
       - name: Upload Linux bundle
         uses: actions/upload-artifact@v4
         with:
-          name: offband-linux-r${{ github.run_number }}-${{ github.sha }}
+          name: offband-linux-r${{ github.run_number }}-${{ github.event.pull_request.head.sha || github.sha }}
           path: build/linux/x64/release/bundle/
           if-no-files-found: error
           retention-days: 14
@@ -94,7 +94,7 @@ jobs:
       - name: Upload web build
         uses: actions/upload-artifact@v4
         with:
-          name: offband-web-r${{ github.run_number }}-${{ github.sha }}
+          name: offband-web-r${{ github.run_number }}-${{ github.event.pull_request.head.sha || github.sha }}
           path: build/web/
           if-no-files-found: error
           retention-days: 14
@@ -112,7 +112,7 @@ jobs:
       - name: Upload Windows build
         uses: actions/upload-artifact@v4
         with:
-          name: offband-windows-r${{ github.run_number }}-${{ github.sha }}
+          name: offband-windows-r${{ github.run_number }}-${{ github.event.pull_request.head.sha || github.sha }}
           path: build/windows/x64/runner/Release/
           if-no-files-found: error
           retention-days: 14