release: prepare Memmy v1.0.6

[syzsunshine219]

Summary

• align all managed project manifests and lockfiles to 1.0.6
• add curated Memmy v1.0.6 release notes
• require the current project version to have a matching versioned release-notes file
• prepare the trusted release/v1.0.6 -> main trigger path

Checks completed

• npm run version:check
• npm run test:release-workflow (11 tests)
• git diff --check
• four expected v1.0.6 OSS objects respond successfully and expose matching Content-MD5 / ETag metadata
• targeted flaky retry: App/memmy-agent/tests/core/agent-runtime/task-cancel.test.ts (21 tests)

Do not merge yet

This PR is intentionally Draft. Merging it will immediately trigger the GitHub Release workflow, so the following release blockers must be resolved first:

1. Rebuild and replace all four OSS installers from this release commit. A read-only sample of the current Windows CN and macOS CN artifacts found outer app metadata at 1.0.6, but the bundled dist/runtime/memmy-agent/package.json is still 1.0.5.
2. Re-run artifact integrity checks after replacement (public URL, size, Content-MD5, SHA-256, and packaged runtime version).
3. Resolve the Full gate distribution-boundary failure: all four Electron Builder configs currently bundle the repository-root .env. A complete fix must preserve the desktop and standalone memmy / memmy-memory runtime configuration path while packaging only allowlisted public configuration; do not merge the old partial patch from PR fix(packaging): exclude raw env from desktop bundles #176 because it breaks standalone CLI configuration.
4. Re-run Project Harness Full on the final clean commit. The first Full run otherwise passed lint, typecheck, local API contracts, desktop assertions, critical smoke, full build, and diff sanity. The Agent suite had two timeout-only failures that passed 21/21 on immediate targeted retry.
5. Obtain independent MemTensor maintainer review. The author must not self-review.

Release behavior

After these blockers are cleared and this exact release/v1.0.6 PR is merged into main, the trusted base workflow will create and publish tag/Release v1.0.6. Do not manually dispatch it while this PR is Draft.