Add --update flag to sync.sh for one-step Code Cannon updates

[sebastientaggart]

Adds a `--update` flag to `sync.sh` so users can update Code Cannon and regenerate skill files from their project root in one step:

```
CodeCannon/sync.sh --update
```

Behavior:

• Checks the current branch of the CodeCannon checkout. If it's `main`, runs `git pull --ff-only` and then proceeds with the normal sync.
• If it's on any other branch, prints a clear message and exits non-zero — no stashing, no checkout, no assumptions about expert users' setups.
• If `git pull --ff-only` fails (dirty tree, non-ff, etc.), prints a clear error and exits.

README updated to document the new one-step update path alongside the existing submodule workflow.

Issue #57

[sebastientaggart]

Review Summary

Verdict: APPROVE

Findings

• [NOTE] After --update fast-forwards the CodeCannon checkout, the already-loaded sync.sh continues executing the pre-pull Python code in memory; only the skills/templates on disk reflect the new version. This is acceptable for the intended use case but worth being aware of if future updates change generator logic in ways that must take effect immediately.