Fix deploy order: start jfr-sidecar after eagle-blue

jfr-sidecar has `pid: "service:eagle-blue"` to share PID namespace for
JFR profiling. It must be started after eagle-blue exists, not before.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

.github/workflows/docker_build.yml

@@ -471,10 +471,13 @@ jobs:
 
       - name: Copy config files to droplet
         run: |
-          scp -i ~/.ssh/deploy_key \
-            docker-compose.prod.yml nginx/nginx.conf \
-            scripts/deploy-blue-green.sh scripts/warmup-eagle.sh scripts/bin/warmup \
-            deploy@"$DO_DROPLET_IP":/opt/eagle0/
+          # Create directory structure on remote
+          ssh -i ~/.ssh/deploy_key deploy@"$DO_DROPLET_IP" "mkdir -p /opt/eagle0/scripts/bin /opt/eagle0/nginx"
+          # Copy files preserving structure
+          scp -i ~/.ssh/deploy_key docker-compose.prod.yml deploy@"$DO_DROPLET_IP":/opt/eagle0/
+          scp -i ~/.ssh/deploy_key nginx/nginx.conf deploy@"$DO_DROPLET_IP":/opt/eagle0/nginx/
+          scp -i ~/.ssh/deploy_key scripts/deploy-blue-green.sh scripts/warmup-eagle.sh deploy@"$DO_DROPLET_IP":/opt/eagle0/scripts/
+          scp -i ~/.ssh/deploy_key scripts/bin/warmup deploy@"$DO_DROPLET_IP":/opt/eagle0/scripts/bin/
 
       - name: Deploy to production droplet
         run: |
@@ -586,7 +589,8 @@ jobs:
           echo "All images pulled successfully"
 
           # Recreate non-Eagle services (not auth - managed by auth_build.yml)
-          docker compose -f docker-compose.prod.yml up -d --no-deps --force-recreate shardok admin jfr-sidecar
+          # Note: jfr-sidecar must start after eagle-blue due to PID namespace sharing
+          docker compose -f docker-compose.prod.yml up -d --no-deps --force-recreate shardok admin
 
           # Deploy Eagle with blue-green (zero-downtime) if scripts are available
           if [ -x "/opt/eagle0/scripts/deploy-blue-green.sh" ]; then
@@ -606,6 +610,9 @@ jobs:
             docker compose -f docker-compose.prod.yml up -d --no-deps --force-recreate eagle-blue
           fi
 
+          # Start jfr-sidecar after eagle-blue (shares PID namespace with eagle-blue)
+          docker compose -f docker-compose.prod.yml up -d --no-deps --force-recreate jfr-sidecar
+
           # Ensure auth is running (but don't force-recreate it)
           docker compose -f docker-compose.prod.yml up -d auth