ci: optional PROD route-tls after deploy (skip if no vanity cert)

[DerekRoberts]

Describe the task

Add bcgov/actions-openshift/route-tls as the last PROD job on Merge so apps with a custom hostname set prod secrets once and ignore TLS after that. Apps without a vanity URL must be unchanged (job skips).

Action: bcgov/actions-openshift#11 (route-tls). First consumer: bcgov/nr-fam#20 (FAM always has a vanity host — no skip there).

Acceptance Criteria

• New job on .github/workflows/merge.yml after deploy-prod (not inside reusable-deploy.yml, not on TEST, not on pr-open.yml)
• environment: prod, permissions: { contents: read }
• Skips when secrets.TLS_CERTIFICATE is empty — clones without a vanity URL stay green
• When secrets are set: hostname from vars.VANITY_URL (or equivalent), target_service: ${{ github.event.repository.name }}-prod-frontend, default route_name (<repo>-vanity-url)
• Pin bcgov/actions-openshift/route-tls to a tag or SHA, not @main
• promote / other post-deploy jobs still needs: [deploy-prod] so an expired vanity cert fails Merge after the app has rolled
• README: prod environment table rows for TLS_CERTIFICATE, TLS_PRIVATE_KEY, TLS_CA_CERTIFICATE, VANITY_URL; Entrust mapping (leaf / key / issuing CA only; no roots, no CSR); PEMs are not workflow_dispatch inputs
• Leave the platform Route (${NAME}-${ZONE}.${DOMAIN}) alone

Additional context

Uninterested consumers: set three prod secrets + hostname var, ignore the rest. Every prod release oc applys the same Route name (update, not a second object). GitHub cannot trigger on secret edits; rotation is “paste new PEMs, next prod ship” or re-run only that job (secrets re-read).

Do not make workflow_dispatch the default story. Do not pass private keys as dispatch inputs (plaintext on the run). Skip-if-empty is the switch: FAM-style apps always set secrets; most quickstart clones never do.

Expired cert should fail the job (vanity SSL is already dead). Platform cluster hostname is unaffected.

Call sketch (only runs when the cert secret is present):

route-tls:
  name: Route TLS (PROD)
  needs: [deploy-prod]
  if: ${{ secrets.TLS_CERTIFICATE != '' }}
  environment: prod
  permissions:
    contents: read
  runs-on: ubuntu-24.04
  steps:
    - uses: bcgov/actions-openshift/route-tls@<tag-or-sha>
      with:
        hostname: ${{ vars.VANITY_URL }}
        target_service: ${{ github.event.repository.name }}-prod-frontend
        tls_certificate: ${{ secrets.TLS_CERTIFICATE }}
        tls_private_key: ${{ secrets.TLS_PRIVATE_KEY }}
        tls_ca_certificate: ${{ secrets.TLS_CA_CERTIFICATE }}
        oc_namespace: ${{ secrets.oc_namespace }}
        oc_server: ${{ vars.oc_server }}
        oc_token: ${{ secrets.oc_token }}

Note: GitHub if: secrets.* can be awkward (empty vs unset). Implement the skip so the job is skipped, not failed, when the vanity cert is absent. Verify that in a clone with no TLS secrets.