The 4.x branch should publish with the `latest-4` tag so it doesn't
override the `latest` tag used by the master branch.

Brings the 4.x maintenance branch onto the same release flow as master
(#814), so every line releases the same way.

**Flow:** run **Prepare Release** (manual, with a version) -> it opens a
`release/vX.Y.Z` PR -> merge it -> **Release** checks the version
against npm, pushes an approval request to DingTalk, waits on the
`release` environment gate, then publishes and creates the GitHub
Release.

**4.x specifics:**
- Publishes under dist-tag `latest-4` (never `latest`).
- Builds via the Vite+ (`vp`) toolchain.
- Replaces the previous tag-based `release.yml`.
- npm auth via OIDC trusted publishing (`id-token: write`).

Requires the repo `release` environment (required reviewers) and npm
trusted-publisher config to allow this branch's workflow. DingTalk
secrets are already set repo-wide.

## Problem

When following a redirect to a different origin, urllib reused the
caller's `options` verbatim, re-sending `Authorization`, `Cookie`, and
`Proxy-Authorization` (and re-injecting Basic/digest auth from `auth` or
the client's `defaultArgs`) to the new origin.

## Fix

When `nextUrl.origin !== requestUrl.origin`, recurse with a cloned
`options` that drops those credential headers (case-insensitive) and
clears `auth`/`digestAuth`, matching the WHATWG Fetch spec and undici's
`RedirectHandler`. Same-origin redirects are unchanged and the caller's
`options` object is never mutated.

## Tests

New `test/options.followRedirect.crossOrigin.test.ts`: cross-origin
strip, same-origin preserve, cross-then-back-to-origin,
`auth`/`defaultArgs` not re-injected cross-origin, and
options-not-mutated.

Release urllib v4.9.1.

Merging this PR updates the version on `4.x` and triggers the release
workflow, which publishes to npm (dist-tag `latest-4`) and creates the
GitHub Release after manual approval.

## What's Changed

### Security

* Do not forward credential headers (`Authorization`, `Cookie`,
`Proxy-Authorization`) on cross-origin redirect, and clear
`auth`/`digestAuth`, matching the WHATWG Fetch spec and undici's
`RedirectHandler` (#812). Same-origin redirects are unchanged and the
caller's `options` object is never mutated.

### Dependencies

* Update runtime dependencies: undici (`^7.24.0`), qs, form-data,
formstream, and type-fest.

### Internal

* Migrate the toolchain to Vite+ (Vitest 4, Oxlint, Oxfmt, tsdown).
* Two-stage release workflow with manual approval, publishing the 4.x
line to the `latest-4` npm dist-tag (#817).

---------

Co-authored-by: fengmk2 <156269+fengmk2@users.noreply.github.com>
Co-authored-by: MK <fengmk2@gmail.com>

npm OIDC trusted publishing needs npm >= 11.5.1, but the setup-vp Node 22
runner ships npm 10.x, so `npm publish` failed with ENEEDAUTH. Node 24
bundles npm 11.13.0, which satisfies the requirement.

Replaces the em dash in the package description with a comma. Also
re-triggers the 4.x release workflow to publish 4.9.1, which the
previous run failed to ship.