fix(ci): correct pnpm config setup and codecov token

Moves the "Setup pnpm config" step to before node setup for better ordering.
Updates the CODECOV_TOKEN to use `secrets.CODECOV_TOKEN` instead of `env.CODECOV_TOKEN`.
This improves security in the CI workflow.

Author: ryanbas21

.github/actions/setup/action.yml

@@ -28,6 +28,10 @@ runs:
       with:
         run_install: false
 
+    - name: Setup pnpm config
+      run: pnpm config set store-dir ${{ inputs.pnpm-cache-folder }} --global
+      shell: bash
+
     - uses: actions/setup-node@v5
       with:
         node-version-file: ${{ inputs.node-version-file }}
@@ -38,10 +42,6 @@ runs:
       run: npm install -g npm@latest
       shell: bash
 
-    - name: Setup pnpm config
-      run: pnpm config set store-dir ${{ inputs.pnpm-cache-folder }} --global
-      shell: bash
-
     - name: Install dependencies
       run: pnpm install --frozen-lockfile
       shell: bash
@@ -50,7 +50,7 @@ runs:
       run: pnpm dlx nx-cloud start-ci-run --distribute-on=".nx/workflows/dynamic-changesets.yml" --stop-agents-after="e2e-ci" --with-env-vars="CODECOV_TOKEN"
       shell: bash
       env:
-        CODECOV_TOKEN: ${{ env.CODECOV_TOKEN }}
+        CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
 
     - name: Cache Playwright browsers
       uses: actions/cache@v4