Fix cert-manager certificate ownership conflict for multi-ingress overlay

[Copilot]

Multiple Ingress resources with cert-manager.io/cluster-issuer annotation on the same TLS secret causes cert-manager to reject updates with "certificate resource is not owned by this object" error.

Changes

• Template: Only add cluster-issuer annotation to routes with primary: true flag
• Values: Mark workflows route as primary by default
• Docs: Document TLS certificate ownership pattern in README and user guide

Usage

ingressAuthzOverlay:
  routes:
    workflows:
      primary: true   # Only this route gets cert-manager.io/cluster-issuer annotation
    applications:
      enabled: true   # References TLS secret but doesn't trigger cert creation

To change the primary route:

routes:
  workflows:
    primary: false
  api:
    primary: true

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.