It seems that any --ports arguments to actool patch-manifest are merely appended to the ports array in the manifest, instead of overwriting it. Is this intended? If so, what's the rationale?

I'd be happy to provide a patch that changes the semantics, or a separate flag that would allow for overwriting if that's preferred.