When building kernel, the build-kernel.sh searches ../../../data/live-build-config/includes.chroot/var/lib/shim-signed/mok to find MOK certs as below.

CERTS=$(find ../../../data/live-build-config/includes.chroot/var/lib/shim-signed/mok -name "*.pem" -type f || true)

Since the working directory is ~/vyos-build/scripts/package-build/linux-kernel/linux/, the right path to search certs is ../../../../data/live-build-config/includes.chroot/var/lib/shim-signed/mok