Move ProvisionerCleanup on the return path

In my opinion it makes more sense to have the provisioner cleanup action on the return path.

I see this action as something that should run at the very last step of the destroy stack.