Add --update flag to sync.sh for one-step Code Cannon updates

[sebastientaggart]

Currently, updating Code Cannon in a project requires three steps: cd into the CodeCannon checkout, git pull, cd back, then run sync.sh. This is awkward and easy to get wrong.

Add a --update flag to sync.sh that self-updates the CodeCannon checkout before running the normal sync, so users can update in a single command from their project root.

To keep things safe for expert users who may be on a non-default branch, the update should only run when the CodeCannon repo is on the main branch. If it's on any other branch, print a clear message and stop — don't try to guess what the expert user wants.

[sebastientaggart]

Agent Implementation Notes

File: sync.sh (single-file change)

Changes:

1. Add --update flag to argparse in main().
2. Early in main() (before config loading), if args.update:
   • Use subprocess.run with git -C <CODECANNON_DIR> rev-parse --abbrev-ref HEAD to get the current branch.
   • If the branch is not main: print a message explaining the update was skipped because CodeCannon is on a different branch, and sys.exit(1). Do not run the normal sync.
   • If on main: run git -C <CODECANNON_DIR> pull --ff-only. On non-zero exit, print a clear error and exit. On success, print a short status line.
3. Fall through to the existing sync logic unchanged.

Why exit(1) on non-main: user explicitly asked to update; silently falling through to a sync-only run would be surprising. Non-zero exit makes it clear nothing happened.

No auto-stash, no checkout, no ref pinning — keep it boring.

README: update the install/update instructions to mention CodeCannon/sync.sh --update as the one-step path.