chore: release v4.7.4 (#5015)

## Summary
5 new features, 12 improvements, 6 bug fixes.

## Improvements
- Self-hosted instances can require custom deploy base images per
runtime via the new `DEPLOY_BASE_IMAGES` and `DEPLOY_BUILD_BASE_IMAGES`
webapp settings. The CLI builds on the images the instance specifies,
and older CLIs are rejected with an upgrade message.
([#5005](#5005))
- Add a `replay_run` tool to the MCP server, so your AI assistant can
replay a run, optionally with a new payload, metadata, tags, machine,
version, delay or other trigger options. It is hidden in `--readonly`
mode.
([`ff2aa236e`](ff2aa23))
- Override a concurrency limit's `perKey` for a single `concurrencyKey`:
`concurrencyLimits.override(name, { concurrencyKey, perKey, ttl })` caps
that one key under that one limit for a while (7 days by default, 30 at
most), `reset(name, { concurrencyKey })` clears it, and `retrieve(name,
{ concurrencyKey })` shows the key's bound and when the override
expires.
([`c49fd05f4`](c49fd05))
- `runs.replay()` now takes options, so you can replay a run with a
different payload, metadata, tags, queue, machine, version, delay and
other trigger options. Anything you leave out comes from the original
run, as before, and the payload is serialized like `trigger()`, so
values like `Date` and `BigInt` keep their types.
([`ff2aa236e`](ff2aa23))
  
  ```ts
  import { runs } from "@trigger.dev/sdk";
  
  await runs.replay("run_1234", {
  payload: { userId: "user_456" },
  tags: ["replayed"],
  delay: "10m",
  });
  ```

## Server changes

These changes affect the self-hosted Docker image and Trigger.dev Cloud:

- Self-hosted instances can add a Cloudflare Turnstile bot check to the
magic-link sign-in form by setting `TURNSTILE_SITE_KEY` and
`TURNSTILE_SECRET_KEY`. It's off unless both are set.
- Recent deployments started from the GitHub integration or a native CLI
deploy can be redeployed from the deployments list, rebuilding the same
commit or upload as a new deployment.
- Each webhook endpoint's request rate limit now comes from the
organization's plan and can be raised per organization, and the limits
page shows it.
- Each environment's webhook endpoints now share a rate limit that
counts larger request bodies as more than one request, set by the
organization's plan and shown on the limits page.
- Webhooks now appear in the dashboard side menu with a Beta badge, and
organizations without access can request beta access from the Webhooks
page. The New badges on Sessions, Prompts and Models are gone.
- The new API key dialog's access summary now shows Errors, Webhooks and
Waitpoints access, and API keys with waitpoint access can create, list
and retrieve waitpoint tokens.
- Log search uses whole-word matching for ASCII alphabetic terms, keeps
substring matching for other terms, and incrementally searches older
logs without blocking the page.
- Magic links now only sign you in from the browser that requested them,
so a link opened elsewhere (including by an email security scanner) no
longer logs anyone in. Self-hosted instances can turn this off with
`MAGIC_LINK_SAME_BROWSER_REQUIRED=false`.
- The multi-factor authentication login page now focuses the code input,
accepts pasted codes, and submits as soon as all six digits are entered.
- Dashboard tabs left in the background now pause their live updates
after 30 seconds and catch up as soon as you return, so idle tabs stop
reloading data nobody is looking at.
- Preview branch auto-archiving is now always available, with no feature
flag to enable first.
- Large run traces now load in chunks and update live without reloading
the page, on child run pages as well as root runs.
- The run page shows one clear trace status next to Cancel and Replay:
whether the run is live, still loading, only partially shown, or failed
to load (with a retry). Search, filters and the run actions now share a
single full-width toolbar.
- Keep blank Vercel imports from overwriting existing values when the
default-off empty environment variable feature is enabled.
- Errors on the login page, such as an expired or invalid magic link, no
longer disappear a moment after the page loads in a new browser.
- Magic-link sign-in emails now always link to `LOGIN_ORIGIN`, whatever
host the request came in on.
- Parent and root metadata updates from child tasks no longer stall
behind a parent run that is being updated by many children at once, and
can optionally be buffered in Redis so they survive a webapp restart.
- Revoking a personal access token is now permanent. Logging in with the
CLI again issues a new token instead of reinstating the revoked one, so
you can rotate a leaked CLI token by revoking it and running `trigger
logout` then `trigger login`.
- Webhook deliveries from a provider's shared IP addresses are no longer
throttled by other customers' traffic or by a spoofed `X-Forwarded-For`
header; the per-IP limit now applies only to requests for endpoints that
don't exist, and every ingest 429 includes `Retry-After`.

<details>
<summary>Raw changeset output</summary>

# Releases
## @trigger.dev/build@4.7.4

### Patch Changes

- Updated dependencies:
  - `@trigger.dev/core@4.7.4`
## trigger.dev@4.7.4

### Patch Changes

- Self-hosted instances can require custom deploy base images per
runtime via the new `DEPLOY_BASE_IMAGES` and `DEPLOY_BUILD_BASE_IMAGES`
webapp settings. The CLI builds on the images the instance specifies,
and older CLIs are rejected with an upgrade message.
([#5005](#5005))
- Add a `replay_run` tool to the MCP server, so your AI assistant can
replay a run, optionally with a new payload, metadata, tags, machine,
version, delay or other trigger options. It is hidden in `--readonly`
mode.
([`ff2aa236e`](ff2aa23))
- Updated dependencies:
  - `@trigger.dev/core@4.7.4`
  - `@trigger.dev/build@4.7.4`
  - `@trigger.dev/schema-to-json@4.7.4`
## @trigger.dev/core@4.7.4

### Patch Changes

- Override a concurrency limit's `perKey` for a single `concurrencyKey`:
`concurrencyLimits.override(name, { concurrencyKey, perKey, ttl })` caps
that one key under that one limit for a while (7 days by default, 30 at
most), `reset(name, { concurrencyKey })` clears it, and `retrieve(name,
{ concurrencyKey })` shows the key's bound and when the override
expires.
([`c49fd05f4`](c49fd05))
- Self-hosted instances can require custom deploy base images per
runtime via the new `DEPLOY_BASE_IMAGES` and `DEPLOY_BUILD_BASE_IMAGES`
webapp settings. The CLI builds on the images the instance specifies,
and older CLIs are rejected with an upgrade message.
([#5005](#5005))
- `runs.replay()` now takes options, so you can replay a run with a
different payload, metadata, tags, queue, machine, version, delay and
other trigger options. Anything you leave out comes from the original
run, as before, and the payload is serialized like `trigger()`, so
values like `Date` and `BigInt` keep their types.
([`ff2aa236e`](ff2aa23))

  ```ts
  import { runs } from "@trigger.dev/sdk";

  await runs.replay("run_1234", {
    payload: { userId: "user_456" },
    tags: ["replayed"],
    delay: "10m",
  });
  ```
## @trigger.dev/python@4.7.4

### Patch Changes

- Updated dependencies:
  - `@trigger.dev/sdk@4.7.4`
  - `@trigger.dev/core@4.7.4`
  - `@trigger.dev/build@4.7.4`
## @trigger.dev/react-hooks@4.7.4

### Patch Changes

- Updated dependencies:
  - `@trigger.dev/core@4.7.4`
## @trigger.dev/redis-worker@4.7.4

### Patch Changes

- Updated dependencies:
  - `@trigger.dev/core@4.7.4`
## @trigger.dev/rsc@4.7.4

### Patch Changes

- Updated dependencies:
  - `@trigger.dev/core@4.7.4`
## @trigger.dev/schema-to-json@4.7.4

### Patch Changes

- Updated dependencies:
  - `@trigger.dev/core@4.7.4`
## @trigger.dev/sdk@4.7.4

### Patch Changes

- Override a concurrency limit's `perKey` for a single `concurrencyKey`:
`concurrencyLimits.override(name, { concurrencyKey, perKey, ttl })` caps
that one key under that one limit for a while (7 days by default, 30 at
most), `reset(name, { concurrencyKey })` clears it, and `retrieve(name,
{ concurrencyKey })` shows the key's bound and when the override
expires.
([`c49fd05f4`](c49fd05))
- `runs.replay()` now takes options, so you can replay a run with a
different payload, metadata, tags, queue, machine, version, delay and
other trigger options. Anything you leave out comes from the original
run, as before, and the payload is serialized like `trigger()`, so
values like `Date` and `BigInt` keep their types.
([`ff2aa236e`](ff2aa23))

  ```ts
  import { runs } from "@trigger.dev/sdk";

  await runs.replay("run_1234", {
    payload: { userId: "user_456" },
    tags: ["replayed"],
    delay: "10m",
  });
  ```

- Updated dependencies:
  - `@trigger.dev/core@4.7.4`

</details>

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: Oskar Otwinowski <oskar.otwinowski@gmail.com>

Author: github-actions[bot]