ci(create-e2e): move YARN_ENABLE_HARDENED_MODE to job-level env

Step-level env with value '0' wasn't propagated through the vp create →
vp install → yarn install chain. Move to job-level env with boolean
false so it's available to all child processes.

Author: fengmk2

.github/workflows/test-vp-create.yml

@@ -144,6 +144,8 @@ jobs:
       # Force full dependency rewriting so the library template's existing
       # vite-plus dep gets overridden with the local tgz
       VP_FORCE_MIGRATE: '1'
+      # Yarn Berry enables hardened mode on public PRs, blocking lockfile creation
+      YARN_ENABLE_HARDENED_MODE: false
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
@@ -172,9 +174,6 @@ jobs:
 
       - name: Run vp create ${{ matrix.template.name }} with ${{ matrix.package-manager }}
         working-directory: ${{ runner.temp }}
-        env:
-          # Yarn Berry enables hardened mode on public PRs, blocking lockfile creation
-          YARN_ENABLE_HARDENED_MODE: '0'
         run: |
           vp create ${{ matrix.template.create-args }} \
             --no-interactive \