feat(git-gate): plumb ExtraHosts through to docker --add-host

GitGateUpstream carries each entry's extra_hosts; a new
git_gate_aggregate_extra_hosts() merges them into one map for the
gate container's /etc/hosts. Same host -> same IP is harmless
duplication; same host -> different IPs is a manifest bug
(/etc/hosts is per-container, not per-upstream) and dies with
the conflicting upstream names.

DockerGitGate.start passes one --add-host host:ip per merged
entry on docker create. Empty map (the default) emits no flags
and is a no-op for bottles that don't need DNS overrides.

claude_bottle/backend/docker/git_gate.py

@@ -8,7 +8,12 @@ import os
 import subprocess
 from pathlib import Path
 
-from ...git_gate import GitGate, GitGatePlan, git_gate_known_hosts_line
+from ...git_gate import (
+    GitGate,
+    GitGatePlan,
+    git_gate_aggregate_extra_hosts,
+    git_gate_known_hosts_line,
+)
 from ...log import die, info, warn
 from ...util import expand_tilde
 from . import util as docker_mod
@@ -101,8 +106,10 @@ class DockerGitGate(GitGate):
             "docker", "create",
             "--name", name,
             "--network", plan.internal_network,
-            GIT_GATE_IMAGE,
         ]
+        for host, ip in git_gate_aggregate_extra_hosts(plan.upstreams).items():
+            create_args.extend(["--add-host", f"{host}:{ip}"])
+        create_args.append(GIT_GATE_IMAGE)
         if subprocess.run(
             create_args,
             stdout=subprocess.DEVNULL,