feat: Add rulesync fetch command to fetch configurations from GitHub

[dyoshikawa]

Summary

• Add new rulesync fetch command to fetch rulesync configuration files directly from GitHub repositories
• Implement GitHub API client using @octokit/rest SDK with authentication support (CLI option, GITHUB_TOKEN, GH_TOKEN)
• Support multiple source formats: full URL, owner/repo, owner/repo@ref, owner/repo:path
• Feature-based filtering (rules, commands, subagents, skills, ignore, mcp, hooks)
• Conflict resolution strategies: skip (preserve existing) and overwrite (default)
• Dry-run mode for previewing changes before writing

Security Measures

• HTTPS enforcement for custom base URLs to prevent token exposure
• Path traversal protection via checkPathTraversal() for both file paths and output directory
• File size limit (10MB max) to prevent resource exhaustion
• Input validation for empty ref/path after delimiters
• Proper URL encoding handled by Octokit SDK

Code Quality Improvements

• Use official GitHub SDK (@octokit/rest) for API interactions
• Extract MAX_FILE_SIZE constant to shared rulesync-paths.ts (eliminates duplication)
• Add RULESYNC_MCP_FILE_NAME and RULESYNC_HOOKS_FILE_NAME constants for consistency
• Remove unused validateRef method from GitHubClient
• Add comprehensive documentation for fetch command in README.md

Test plan

• Unit tests for GitHub client (authentication, API calls, error handling)
• Unit tests for source parsing (URL formats, shorthand formats)
• Unit tests for fetch logic (filtering, conflict resolution, file writing)
• Unit tests for CLI command handler
• Unit tests for security measures (path traversal, file size limits, HTTPS validation)
• Unit tests for output directory path traversal validation
• All 3547 tests pass
• pnpm cicheck:code passes

🤖 Generated with Claude Code