This was solved on the chat : turns out there was a missing /debian in the sources.list line. The line should read :
deb http://forge.yunohost.org/debian stretch stable
Not sure why the /debian was missing but it was dating back from the jessie instance (apparently ~3 years old) - maybe a very old piece of code during the install at that time …