release: 1.0.6

Patch is even (6) and bare, so this is classified as 'stable' by
the validate-release job in .github/workflows/docker-publish-android.yml.

Move the Unreleased section up by inserting [1.0.6] below it, with
a list of changes that landed on this release:

  - Self-hosted Forgejo Actions runner now drives CI on yavsc,
    using pazof/yavsc-build-env:debian12-dotnet10-android36-v1
    pulled from Docker Hub.
  - .forgejo/workflows/buildAndTest.yml builds without
    actions/checkout (image has no Node) and uses NuGet.config
    for the isn.pschneider.fr feed.
  - Dockerfile / Dockerfile.backend drop the redundant
    'dotnet nuget add source' step that broke the APK build on
    GitHub Actions.

CHANGELOG.md

@@ -26,4 +26,27 @@ pour la production des paquets `.deb`.
 
 ### Removed
 
+## [1.0.6] - stable
+
+### Added
+- Self-hosted Forgejo Actions runner now drives the CI build for the
+  yavsc repository, using the
+  `pazof/yavsc-build-env:debian12-dotnet10-android36-v1` image pulled
+  from Docker Hub. Workflow runs end-to-end: clone, restore, build,
+  test, with NuGet.config picking up the `isn.pschneider.fr` feed.
+
+### Changed
+- CI workflow `.forgejo/workflows/buildAndTest.yml` no longer relies on
+  `actions/checkout` (the runner image has no Node); clones yavsc via
+  `git`, fetches the ref under test, and initializes submodules over
+  HTTPS.
+
+### Fixed
+- `Dockerfile` and `Dockerfile.backend` no longer carry a redundant
+  `dotnet nuget add source` step that conflicted with the GitHub
+  Actions APK build (`--allow-insecure-connections` on an HTTPS
+  endpoint, exit 1). `NuGet.config` at the repo root supplies the
+  `isn.pschneider.fr` feed for every restore, including inside Docker.
+
 [Unreleased]: https://github.com/pazof/yavsc/compare/HEAD
+[1.0.6]: https://github.com/pazof/yavsc/compare/1.0.5...1.0.6