Fixes two sync bugs that caused rendered skill files to contain broken content for common configurations.

1. VERSION_READ_CMD rendered as an unterminated shell command. parse_yaml_simple used .strip('"').strip("'"), which greedily strips all trailing quote characters. For the default template value "node -p \"require('./package.json').version\"" this produced node -p \"require('./package.json').version\ — missing a closing quote, with a trailing backslash. Copy-paste into a shell failed.

2. {{TICKET_LABEL_CREATION_ALLOWED}} leaked through to rendered skill files. The start skill references this setting, but the default .codecannon.yaml template ships it commented out. Projects that configured a ticket-label pool without uncommenting the key ended up with raw mustache placeholders in the rendered start skill.

Changes

• New _dequote() helper in sync.sh that strips exactly one pair of matching outer quotes and decodes \" / \\ in double-quoted values. Wired into the three value sites in parse_yaml_simple and parse_frontmatter, plus the list-item sites.
• TICKET_LABEL_CREATION_ALLOWED defaults to "false" when absent from the project config, matching the documented default in templates/codecannon.yaml and docs/config-reference.md.

No skill-file changes required — the placeholders already render correctly once the sync engine behaves.

Verification

• ./sync.sh --validate passes.
• ./sync.sh --dry-run against this repo is a clean no-op (this repo uses cat VERSION and has all label keys set explicitly, so it's unaffected by either bug).
• Parsing the default templates/codecannon.yaml now yields VERSION_READ_CMD = 'node -p "require(\'./package.json\').version"' with balanced quotes.

Issue #68