Fix default value for TMP_GEN_DIR

The default value was set to /var/tmp. This is bad, because it's not a directory prefix, it's a filename prefix. So the cert agent was trying to create temp working directories with names like /var/tmpAEOUCaoeu. And since most users don't have write perms to /var, that was failing.

Then we added the trailing /. Now it was creating /var/tmp/aeostdhaeou, which was better, except it assumes that the directory in which you're doing your work belongs exclusively to the user running the certificate agent. Consequently, when you do test runs using create_pdf, it would try to helpfully clean up after itself by doing rm -rf on /var/tmp. Which would be a bad idea even if you were running certs as a user who was allowed to do that.

In prod, we have this value configured to be ```/tmp/certs-``` which seems to work pretty well, so I think it would make sense to just make the default behavior that.