sync: upstream v4.0.0

[rbfernan]

Sync retry-step to upstream v4.0.0

Classification: patched
Security assessment: clean — breaking change noted below
Patch compatibility: no conflicts detected
Sync range: v3.0.0 → v4.0.0

Upstream releases included (v3.0.0 → v4.0.0)

• v3.0.1 — fix: group log lines for each attempt — release notes
• v3.0.2 — fix: resolve automated release issue that prevented v3.0.1 from being properly published — release notes
• v4.0.0 — breaking: upgrades runtime to Node 24 (node20 → node24 in action.yml) — release notes

Pipedrive patches carried forward

• feat(DTL-5915): update package lock (#2) — bumps braces (3.0.2→3.0.3), fill-range (7.0.1→7.1.1), and undici (5.28.2→5.28.4) in package-lock.json to address CVEs

Note: Fork's dependency patch is now redundant — upstream v4.0.0 regenerated the full lockfile for Node 24, which supersedes the pinned versions. The lock file was auto-merged cleanly. Consider removing this patch from future fork resets.

⚠️ This PR includes a major version bump from v3 to v4. v3-pipedrive will NOT be moved — consumers on @v3-pipedrive remain on v3.0.0 and are safe. To enable migration, cut a v4-pipedrive tag after merging and advise consumers to update their ref.

---

Post-merge checklist

# Tag the merged commit — v4.0.0 content with PD patches
SHA=$(gh api repos/pipedrive-actions/retry-step/branches/main --jq '.commit.sha')
git tag v4.0.0-pipedrive "$SHA"
git push origin v4.0.0-pipedrive

# DO NOT move v3-pipedrive — it stays at v3.0.0 + PD patches.
# That commit is still safe. Consumers on @v3-pipedrive continue working unchanged.
# To open the v4 migration path, optionally cut:
# git tag v4-pipedrive "$SHA"
# git push origin v4-pipedrive
# Then advise consumers to migrate their ref from @v3-pipedrive to @v4-pipedrive.