fix(genTaskOriginSig): use absolute paths for ottr cli certificate output

[Sertug17]

In generateDeviceCertificate(), the --certificate-path and --private-key-path
flags passed bare filenames (device-certificate.pem) to ottr-cli. Most CLI tools
resolve relative paths from the current working directory, not from ~/.ottr/.

However, the code immediately after reads the files from ~/.ottr/device-certificate.pem
and ~/.ottr/device-certificate-key.pem using path.join(CERT_PATH, DEVICE_CERT).

This mismatch causes:
1. ENOENT errors when the files aren't found at ~/.ottr/ (if ottr-cli writes to CWD)
2. Silent use of stale certificates from a prior run (if ~/.ottr/ files happen to exist)

Fix: Use absolute paths path.join(CERT_PATH, DEVICE_CERT) consistently same path
for writing and reading.

[cb-heimdall]

🟡 Heimdall Review Status

Requirement	Status	More Info
Reviews	🟡 0/1	Denominator calculation Show calculation 1 if user is bot 0 1 if user is external 0 2 if repo is sensitive 0 From .codeflow.yml 1 Additional review requirements Show calculation Max 0 0 From CODEOWNERS 0 Global minimum 0 Max 1 1 1 if commit is unverified 1 Sum 2