[Feature]: Surface `--output`, `--valid-days` and `--export-cer` in `winapp cert generate`

Is your feature request related to a problem? Please describe.

winapp.certGenerate runs cert generate (or cert generate --install) with no other arguments, so several winappcli options are unreachable from the extension:

• --output — where the PFX is written. Users are stuck with devcert.pfx in the project directory and cannot put certificates in, say, a certs/ or build/ folder.
• --valid-days — certificate validity period. Users are stuck with the CLI default of 365 days and cannot shorten it for a short-lived test certificate or lengthen it to avoid re-trusting a dev certificate every year.
• --export-cer — emit a .cer (public key only) alongside the .pfx. The .cer is the artifact you hand to a colleague or a test machine in order to trust the certificate, so not being able to ask for one is a real gap for anyone sharing a dev certificate across machines.

Background: the extension's command surface was designed against winappcli ~0.3.1, while scripts/download-cli.ps1 downloads latest (now 0.6.x). The result is a 0.6.x CLI shipping behind a 0.3.x UI, with these options present in the bundled binary but not surfaced anywhere.

These were deliberately split out of the in-flight cert generate work so that change can stay focused on correctness (publisher/manifest matching, and making failures visible in VS Code at all) rather than growing a configuration surface at the same time.

Describe the solution you'd like

Expose the three options without turning a two-click command into a multi-prompt interrogation. The design sketched during the cert generate review, for whoever picks this up:

• Settings for values a user sets once per project and then never wants to be asked about again:
  • winapp.cert.outputPath (default "" ⇒ CLI default devcert.pfx in the project directory)
  • winapp.cert.validDays (default 365, matching the CLI)
  • winapp.cert.exportCer (default worth discussing — see note below)
• An "Advanced options…" entry appended to the existing generate QuickPick, opening a single canPickMany checklist (Custom output path, Custom validity period, Export .cer alongside .pfx, Override publisher) that then prompts only for the rows the user ticked, with answers recalled from workspaceState for the next run.

The point of the two-tier shape is that the default path gains zero prompts, one extra click reaches the full surface, and the user only answers as many questions as they explicitly asked for.

Note on --export-cer: consider defaulting it on. The .cer costs nothing to produce, contains no secret, and is what you hand to someone else to trust. It is also what allows "generate and install" to elevate only cert install <the .cer> instead of the .pfx — installing the .pfx imports the private key into the machine store, which is more privilege than trusting the certificate requires.

Additional context

Related work and issues:

• The in-flight cert generate change covers --manifest / --publisher (so the certificate's publisher matches the manifest) and --if-exists, and moves the command off the fire-and-forget terminal transport onto spawn + --json so exit codes and errors are actually visible. That transport change is a prerequisite for anything here that needs to read back the generated paths.
• #242 tracks --password support across the cert commands.
• The underlying version drift is worth addressing on its own: scripts/download-cli.ps1 defaults to latest, so the UI silently falls further behind each CLI release. Pinning the downloaded version, or asserting a minimum version at activation using the CLI's --cli-schema self-description, would stop this recurring.

Start at the existing winapp.certGenerate command and its generate QuickPick, then inspect how extension settings and workspaceState are currently handled. Review the in-flight cert generate transport change before adding these options, and check scripts/download-cli.ps1 for the CLI version context. Done means the three CLI options are reachable without prompts by default, through the proposed advanced flow, and their values persist as specified.