ci: optional PROD route-tls after deploy (skip if no vanity cert)

**Describe the task**

Add `bcgov/actions-openshift/route-tls` as the last **PROD** job on Merge so apps with a custom hostname set `prod` secrets once and ignore TLS after that. Apps without a vanity URL must be unchanged (job skips).

Action: [bcgov/actions-openshift#11](https://github.com/bcgov/actions-openshift/pull/11) (`route-tls`). First consumer: [bcgov/nr-fam#20](https://github.com/bcgov/nr-fam/issues/20) (FAM always has a vanity host — no skip there).

**Acceptance Criteria**

- [ ] New job on `.github/workflows/merge.yml` after `deploy-prod` (not inside `reusable-deploy.yml`, not on TEST, not on `pr-open.yml`)
- [ ] `environment: prod`, `permissions: { contents: read }`
- [ ] Skips when `secrets.TLS_CERTIFICATE` is empty — clones without a vanity URL stay green
- [ ] When secrets are set: `hostname` from `vars.VANITY_URL` (or equivalent), `target_service: ${{ github.event.repository.name }}-prod-frontend`, default `route_name` (`-vanity-url`)
- [ ] Pin `bcgov/actions-openshift/route-tls` to a tag or SHA, not `@main`
- [ ] `promote` / other post-deploy jobs still `needs: [deploy-prod]` so an expired vanity cert fails Merge **after** the app has rolled
- [ ] README: `prod` environment table rows for `TLS_CERTIFICATE`, `TLS_PRIVATE_KEY`, `TLS_CA_CERTIFICATE`, `VANITY_URL`; Entrust mapping (leaf / key / issuing CA only; no roots, no CSR); PEMs are not workflow_dispatch inputs
- [ ] Leave the platform Route (`${NAME}-${ZONE}.${DOMAIN}`) alone

**Additional context**

Uninterested consumers: set three `prod` secrets + hostname var, ignore the rest. Every prod release `oc apply`s the same Route name (update, not a second object). GitHub cannot trigger on secret edits; rotation is “paste new PEMs, next prod ship” or re-run **only** that job (secrets re-read).

Do not make `workflow_dispatch` the default story. Do not pass private keys as dispatch inputs (plaintext on the run). Skip-if-empty is the switch: FAM-style apps always set secrets; most quickstart clones never do.

Expired cert should fail the job (vanity SSL is already dead). Platform cluster hostname is unaffected.

**Call sketch** (only runs when the cert secret is present):

```yaml
route-tls:
name: Route TLS (PROD)
needs: [deploy-prod]
if: ${{ secrets.TLS_CERTIFICATE != '' }}
environment: prod
permissions:
contents: read
runs-on: ubuntu-24.04
steps:
- uses: bcgov/actions-openshift/route-tls@
with:
hostname: ${{ vars.VANITY_URL }}
target_service: ${{ github.event.repository.name }}-prod-frontend
tls_certificate: ${{ secrets.TLS_CERTIFICATE }}
tls_private_key: ${{ secrets.TLS_PRIVATE_KEY }}
tls_ca_certificate: ${{ secrets.TLS_CA_CERTIFICATE }}
oc_namespace: ${{ secrets.oc_namespace }}
oc_server: ${{ vars.oc_server }}
oc_token: ${{ secrets.oc_token }}
```

Note: GitHub `if: secrets.*` can be awkward (empty vs unset). Implement the skip so the job is skipped, not failed, when the vanity cert is absent. Verify that in a clone with no TLS secrets.