chore: bump to 0.7.4-rc.0 for OIDC test publish

Pre-release bump to validate npm OIDC trusted publishing end to end:
workflow trigger, Environment approval gate, Trusted Publisher match,
provenance attestation. Will not be tagged as `latest` on npm (npm
auto-excludes SemVer pre-releases from dist-tags). After this RC
succeeds, cut 0.7.4 proper.

package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "codeburn",
-  "version": "0.7.3",
+  "version": "0.7.4-rc.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "codeburn",
-      "version": "0.7.3",
+      "version": "0.7.4-rc.0",
       "license": "MIT",
       "dependencies": {
         "chalk": "^5.4.1",

package.json

@@ -1,6 +1,6 @@
 {
   "name": "codeburn",
-  "version": "0.7.3",
+  "version": "0.7.4-rc.0",
   "description": "See where your AI coding tokens go - by task, tool, model, and project",
   "type": "module",
   "main": "./dist/cli.js",