Replace the repositories an owned node may receive a token for

Replace the picked set and wake the pusher.

Every id must be a repository of one of this account's live installations: an id from another account, an unknown one, or one of an uninstalled App is a 422 that names nothing (the ids are not this caller's to enumerate). The write is a replace, not a merge, so the console's checkbox list is the whole truth. The pusher is woken after the commit; a narrowing reaches the node and revokes the old token from there (D-GH-C4), never from this request.