release 1.0.6: bump packaging defaults, add CHANGELOG, CI workflow

- Makefile + debian/rules: POSTIT_GIT_TAG default 1.0.0 → 1.0.6.
- CHANGELOG.md: document the 1.0.6 release (workflow rollout).
- .github/workflows/build-and-release-deb.yml: GitHub Actions workflow
  that builds postit_*.deb (matrix amd64+arm64 via cross-RID .NET on
  amd64 runners) from a tag pushed to this repo, validates the tag
  (semver, patch-parity channel, CHANGELOG section), and publishes a
  GitHub Release with both .deb as assets. Refuses to re-tag an
  existing release by default (re-tag = le mal); opt-in via
  workflow_dispatch + force_republish=true.

Pattern mirrors yavsc/.github/workflows/docker-publish-android.yml.

debian/rules

@@ -20,7 +20,7 @@
 #      of the dh_* helpers assemble the .deb.
 
 POSTIT_GIT_URL ?= https://github.com/pazof/yavsc.git
-POSTIT_GIT_TAG ?= 1.0.0
+POSTIT_GIT_TAG ?= 1.0.6
 # Runtime identifier passed to `dotnet publish --runtime`. Override
 # at build time for non-amd64 targets:
 #   make deb POSTIT_RUNTIME=linux-arm64