feat(manifest): add ExtraHosts to bottle.git entries

Optional `ExtraHosts: { hostname: ip }` map per git entry. The
docker backend will surface these to the gate sidecar via
--add-host so the gate can resolve upstreams whose default
container DNS doesn't point at the reachable IP (e.g.
Tailscale-only hosts with a public DNS A record pointed
elsewhere). The agent-side insteadOf rewrite still keys off
the original hostname, so the manifest's Upstream URL stays
human-readable.

tests/unit/test_manifest_git.py

@@ -111,6 +111,53 @@ class TestGitEntryParsing(unittest.TestCase):
             }]))
 
 
+class TestGitEntryExtraHosts(unittest.TestCase):
+    def test_extra_hosts_defaults_to_empty(self):
+        m = Manifest.from_json_obj(_manifest([{
+            "Name": "foo",
+            "Upstream": "ssh://git@github.com/foo.git",
+            "IdentityFile": "/dev/null",
+        }]))
+        self.assertEqual({}, dict(m.bottles["dev"].git[0].ExtraHosts))
+
+    def test_extra_hosts_parses_host_to_ip_map(self):
+        m = Manifest.from_json_obj(_manifest([{
+            "Name": "claude-bottle",
+            "Upstream": "ssh://git@gitea.dideric.is:30009/didericis/claude-bottle.git",
+            "IdentityFile": "/dev/null",
+            "ExtraHosts": {"gitea.dideric.is": "100.78.141.42"},
+        }]))
+        eh = dict(m.bottles["dev"].git[0].ExtraHosts)
+        self.assertEqual({"gitea.dideric.is": "100.78.141.42"}, eh)
+
+    def test_extra_hosts_must_be_object(self):
+        with self.assertRaises(Die):
+            Manifest.from_json_obj(_manifest([{
+                "Name": "foo",
+                "Upstream": "ssh://git@github.com/foo.git",
+                "IdentityFile": "/dev/null",
+                "ExtraHosts": ["gitea.dideric.is", "100.78.141.42"],
+            }]))
+
+    def test_extra_hosts_ip_must_be_string(self):
+        with self.assertRaises(Die):
+            Manifest.from_json_obj(_manifest([{
+                "Name": "foo",
+                "Upstream": "ssh://git@github.com/foo.git",
+                "IdentityFile": "/dev/null",
+                "ExtraHosts": {"gitea.dideric.is": 100},
+            }]))
+
+    def test_extra_hosts_empty_ip_dies(self):
+        with self.assertRaises(Die):
+            Manifest.from_json_obj(_manifest([{
+                "Name": "foo",
+                "Upstream": "ssh://git@github.com/foo.git",
+                "IdentityFile": "/dev/null",
+                "ExtraHosts": {"gitea.dideric.is": ""},
+            }]))
+
+
 class TestGitEntryCrossValidation(unittest.TestCase):
     def test_duplicate_name_dies(self):
         with self.assertRaises(Die):