Which repositories this workspace may deploy from

Owner-only. restricted: false (the default) means every repository the workspace’s GitHub connections grant; true means only what mode names — repos (allowed) or orgs (allowedOrgs, GitHub accounts, matched against the owner half of owner/name). Both lists are kept while the other mode is active. candidateOrgs is the accounts this workspace is connected to. candidates is what the caller can choose from — the repositories the connections grant that THIS PERSON can also see on GitHub — and is never narrowed by the list itself, so a removed repository can be added back.