Devcontainer: init-firewall.sh aborts on boot when two allowlisted domains resolve to the same IP (ipset duplicate + set -e)

## Summary

The official devcontainer fails on first boot when two domains in `init-firewall.sh`'s allowlist resolve to the same IP address. The script runs under `set -euo pipefail`, and the per-domain resolution loop adds each resolved IP with `ipset add allowed-domains "$ip"`. On a duplicate, `ipset` errors:

```
ipset v7.17: Element cannot be added to the set: it's already added
```

`set -e` then aborts the script, `postStartCommand` exits 1, and the container comes up without completing firewall initialization:

```
postStartCommand from devcontainer.json failed with exit code 1.
Error: Command failed: /bin/sh -c sudo /usr/local/bin/init-firewall.sh
```

## Reproduction

Deterministic whenever two allowlisted domains share an IP, which is common with CDN-fronted hosts. Observed live on 2026-09-01 (stock `.devcontainer` from `main`, Docker Desktop on Windows 11 + `@devcontainers/cli`): `marketplace.visualstudio.com` and `vscode.blob.core.windows.net` both resolved to `150.171.74.16`, so the second add failed and the boot aborted, every run.

## Fix (one line)

Use ipset's idempotent add in the per-domain loop:

```diff
- ipset add allowed-domains "$ip"
+ ipset add -exist allowed-domains "$ip"
```

The aggregate CIDR loop above it could take the same flag if overlapping ranges ever appear in GitHub's meta ranges; the minimal fix only touches the per-domain loop.

Since this repo doesn't accept external pull requests, the change is ready to cherry-pick from pedro-silva-hub/claude-code@001c048d6eba062d8bbf7f7e2d538f00e833e28b (branch `fix/devcontainer-ipset-exist`).

## Verification after the fix

Container boots clean and default-deny still holds: non-allowlisted domain blocked, `registry.npmjs.org` reachable, `sudo -n iptables` denied for the `node` user, workspace-only writes enforced.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

https://claude.ai/code/session_013MrVJ8vhVRNyP3JjhM3VRG

Start with init-firewall.sh in the devcontainer setup and the postStartCommand in devcontainer.json mentioned in the issue. The reported failure is ipset add aborting under set -e when two allowlisted domains resolve to the same IP. Done means duplicate resolved IPs no longer abort boot, the devcontainer starts cleanly, and the listed firewall checks still pass.

Written by the indexing model from the issue text.