chore: bump version and changelog (v0.7.4.0)

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

CHANGELOG.md

@@ -5,6 +5,24 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to a four-digit MAJOR.MINOR.PATCH.MICRO version scheme.
 
+## [0.7.4.0] - 2026-06-18
+
+### Added
+
+- **`secrets upgrade` verb (EGB-716)** — the fix path paired with the EGB-713
+  version-skew *warning*. Until now the warning told you you were behind but not
+  how to catch up; `secrets upgrade` closes that loop.
+  - **`secrets upgrade`** — `git -C "$SCRIPT_DIR" pull --ff-only` on the tool's
+    own checkout (fast-forward only — never merges or rewrites local commits),
+    reports `vOLD -> vNEW`, then best-effort re-checks the store's recorded
+    writer-version against the new version so you see whether the EGB-713 nudge
+    is now cleared (the new code itself takes effect on your next command).
+  - **`secrets upgrade --check`** — reports whether an update is available
+    (`git fetch` + compare to upstream) and changes nothing.
+  - Deliberately thin: no auto-update, no background polling (this is a security
+    tool). Directed errors for not-a-git-checkout, no upstream, a diverged/dirty
+    branch, or being offline.
+
 ## [0.7.3.1] - 2026-06-18
 
 ### Changed