Read the PKCS#11 token PIN from NB_TPM_PIN instead of the profile config

client/internal/debug/debug.go

@@ -743,6 +743,8 @@ func (g *BundleGenerator) addCommonConfigFields(configContent *strings.Builder)
 	configContent.WriteString(fmt.Sprintf("LocalMetricsEnabled: %v\n", g.internalConfig.LocalMetricsEnabled))
 	configContent.WriteString(fmt.Sprintf("LocalMetricsAddress: %s\n", g.internalConfig.LocalMetricsAddress))
 	configContent.WriteString(fmt.Sprintf("SyncMessageVersion: %v\n", g.internalConfig.SyncMessageVersion))
+	configContent.WriteString(fmt.Sprintf("CertStoreDir: %s\n", g.internalConfig.CertStoreDir))
+	configContent.WriteString(fmt.Sprintf("CertPKCS11URISet: %v\n", g.internalConfig.CertPKCS11URI != ""))
 
 	if g.internalConfig.DisableNotifications != nil {
 		configContent.WriteString(fmt.Sprintf("DisableNotifications: %v\n", *g.internalConfig.DisableNotifications))

client/internal/debug/debug_test.go

@@ -846,6 +846,7 @@ func TestAddConfig_AllFieldsCovered(t *testing.T) {
 		"Name":                 "non-config: profile name is not needed for debug purposes",
 		"policy":               "non-config: in-memory MDM policy snapshot, surfaced via Config.Policy() / GetConfigResponse.MDMManagedFields",
 		"DebugBundleUploadURL": "sensitive: MDM-provided upload URL may carry credentials or query tokens; kept out of the shared bundle",
+		"CertPKCS11URI":        "sensitive: the URI may carry the token PIN as pin-value; only whether it is set is rendered",
 	}
 
 	mURL, _ := url.Parse("https://api.example.com:443")