Fix firewall init crash on overlapping IPs across allowlisted domains

pypi.org and files.pythonhosted.org share Fastly edge IPs, so the second
domain's ipset add hit a duplicate-element error. Without -exist, that
error plus set -e killed the whole firewall init (and thus the container)
before nvim ever started. Reported by the user as a silent hang after a
successful build.

docker/claude-sandbox/init-firewall.sh

@@ -79,7 +79,11 @@ for domain in \
             exit 1
         fi
         echo "Adding $ip for $domain"
-        ipset add allowed-domains "$ip"
+        # -exist: two domains can resolve to the same IP (e.g. pypi.org and
+        # files.pythonhosted.org share Fastly edge IPs), and ipset otherwise
+        # errors on a duplicate add, which -e/set -e turns into the whole
+        # firewall (and thus the container) failing to start.
+        ipset add allowed-domains "$ip" -exist
     done < <(echo "$ips")
 done