ci: move provenance check out of setup action

[lachlancollins]

🎯 Changes

#287 is blocking a lot of workflows from running due to false errors (e.g. when vite v6 gets installed, but v7 was installed prior).

✅ Checklist

• I have followed the steps in the Contributing guide.
• I have tested this code locally with pnpm test:pr.

🚀 Release Impact

• This change affects published code, and I have generated a changeset.
• This change is docs/CI/dev-only (no release).

[changeset-bot]

⚠️ No Changeset found

Latest commit: 2eb5006

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[nx-cloud]

View your CI Pipeline Execution ↗ for commit 2eb5006

Command	Status	Duration	Result
nx affected --targets=test:eslint,test:types,te...	✅ Succeeded	2s	View ↗
nx run-many --target=build	✅ Succeeded	<1s	View ↗

---

☁️ Nx Cloud last updated this comment at 2025-09-26 08:00:13 UTC

[pkg-pr-new]

@tanstack/config

npm i https://pkg.pr.new/@tanstack/config@291

@tanstack/eslint-config

npm i https://pkg.pr.new/@tanstack/eslint-config@291

@tanstack/publish-config

npm i https://pkg.pr.new/@tanstack/publish-config@291

@tanstack/typedoc-config

npm i https://pkg.pr.new/@tanstack/typedoc-config@291

@tanstack/vite-config

npm i https://pkg.pr.new/@tanstack/vite-config@291

commit: 2eb5006