update quickstart

docs/user-guide/quickstart.md

@@ -596,7 +596,6 @@ Expected output:
 ```
 team-a
 ├── [s] service-2
-├── [s] service-3
 └── [s] service-4
      └── staging
 ```
@@ -650,7 +649,7 @@ kubectl -n team-b get secrets
 But now we’ve started running an untrusted service in `team-b`, so we’ve decided not to share that secret with it anymore. We can do this by setting the propagation selectors on the secret:
 
 ```bash
-kubectl annotate secret my-secret -n acme-org propagate.hnc.x-k8s.io/treeSelect=!team-b
+kubectl annotate secret my-secret -n acme-org propagate.hnc.x-k8s.io/treeSelect='!team-b'
 ```
 
 Now you’ll see the secret is no longer accessible from `team-b`: