Fix deploy-qa health check unreachable from runner's network namespace

The self-hosted runner runs in its own container on a separate bridge
network, so curling localhost:$QA_ADMIN_PORT hit the runner's own loopback
instead of the docker host's published port, never the QA stack.
Exec into the admin container and curl its own localhost instead.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

scripts/ci/deploy-qa.sh

@@ -24,9 +24,14 @@ $COMPOSE down -v
 log "Starting QA stack"
 $COMPOSE up -d
 
-log "Waiting for API health check via admin proxy on port $QA_ADMIN_PORT"
+log "Waiting for API health check via admin proxy"
+# Checked with `docker compose exec` rather than curling the published host
+# port: CI runs this script inside a runner container on its own bridge
+# network, where "localhost:$QA_ADMIN_PORT" is the runner's own loopback, not
+# the docker host's - it can never reach a host-published port. Exec'ing into
+# the admin container and curling its own localhost sidesteps that entirely.
 attempts=30
-until curl -fsS "http://localhost:${QA_ADMIN_PORT}/health" >/dev/null 2>&1; do
+until $COMPOSE exec -T admin curl -fsS http://localhost/health >/dev/null 2>&1; do
   attempts=$((attempts - 1))
   if [[ "$attempts" -le 0 ]]; then
     fail "QA stack did not become healthy in time"