Clean up TLS default path logic. Use convention if config isn't present.

[sourishkrout]

Move cert/key path defaulting into LoadConfig and remove the redundant fallback from ensureTLSCertificate.

1. Use local constants instead of the deprecated tlsbuilder.CertPEMFile/KeyPEMFile.
2. Nest the two path checks under a single if tls.Generate guard.

[Copilot]

Pull request overview

This PR centralizes TLS cert/key path defaulting in application.App.LoadConfig, removing redundant fallback logic from the certificate-check command so TLS generation consistently uses the config-directory convention when paths aren’t provided.

Changes:

• Add cert.pem / key.pem defaulting in App.LoadConfig when assistantServer.tlsConfig.generate is enabled and paths are empty.
• Remove the ensureTLSCertificate fallback that previously set default cert/key paths in the certificate-check command.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
pkg/agent/cmd/certificate_check.go	Removes redundant TLS cert/key path fallback before calling tlsbuilder.LoadOrGenerateConfig.
pkg/agent/application/app.go	Introduces default TLS cert/key filenames and applies defaulting during config load when TLSConfig.Generate is true.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.