add waitforcert to puppet agent run, to help with initial registrations