Publisher: idempotent writes with upsert

final hostItem = await nodes.upsert(
  id: hostId,
  obj: HostNode(hostname: hostname, firstSeenMs: now),
  sharedWith: otherAtSigns,
);

• upsert is the idempotent create-or-update verb. The publisher restarts every few minutes, and strict create would throw StateError because the previous run's self-key is still alive on the atServer.
• create is still there for "treat any collision as a bug" semantics, typically only when the SDK auto-generates the id.
• Same arg shape as create; pick whichever semantic fits.