Extract rain as standalone git-rain CLI

Promotes the reverse-sync command from git-fire into its own first-class
project. Rain is now the root command (not a subcommand), uses the
git-rain-backup-* branch prefix, config at ~/.config/git-rain/, and adds
a --fetch-only flag absent from the original.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: bschellenberger2600

.github/workflows/ci.yml

@@ -0,0 +1,30 @@
+name: CI
+
+on:
+  push:
+    branches: ["**"]
+  pull_request:
+    branches: ["**"]
+
+permissions:
+  contents: read
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-go@v5
+        with:
+          go-version-file: go.mod
+          cache: true
+
+      - name: Build
+        run: go build ./...
+
+      - name: Vet
+        run: go vet ./...
+
+      - name: Test
+        run: go test -race -count=1 ./...

.gitignore

@@ -0,0 +1,5 @@
+# Built binary
+git-rain
+
+# macOS
+.DS_Store

CLAUDE.md

@@ -0,0 +1,72 @@
+# CLAUDE.md — git-rain
+
+## Project Overview
+
+`git-rain` is a standalone Go CLI that syncs local git repositories _from_ their remotes — the reverse of `git-fire`. It is extracted from the `git-fire` codebase and promoted to a first-class tool.
+
+Module: `github.com/git-rain/git-rain`
+Go version: 1.24.2
+Config: `~/.config/git-rain/config.toml`
+Registry: `~/.config/git-rain/repos.toml`
+Logs: `~/.cache/git-rain/` (not yet wired up)
+
+---
+
+## Commands
+
+```bash
+make build       # compile binary to ./git-rain
+make run ARGS="--dry-run"  # build and run with flags
+make test        # run all tests
+make test-race   # run tests with race detector (used in CI)
+make lint        # go vet ./...
+make install     # install to $GOPATH/bin
+make clean       # remove binary
+```
+
+Run directly:
+
+```bash
+go build ./...
+go test -race -count=1 ./...
+go vet ./...
+```
+
+---
+
+## Architecture
+
+```
+main.go
+  └── cmd/root.go            # Cobra CLI: flags, orchestration (rain is the root command)
+      ├── internal/config    # Load config (~/.config/git-rain/config.toml)
+      ├── internal/git       # Repo scanning + git operations (shells out to git binary)
+      ├── internal/registry  # Persistent repo registry (~/.config/git-rain/repos.toml)
+      ├── internal/safety    # Secret detection + error/log sanitization
+      └── internal/flavor    # Rain-themed startup quotes
+```
+
+**Key design decisions:**
+- Uses native `git` binary via `exec.Command` — not go-git.
+- Backup branch prefix: `git-rain-backup-` (was `git-fire-rain-backup-` in git-fire).
+- Config env prefix: `GIT_RAIN_`.
+- Safe mode (default): never rewrites local-only commits.
+- Risky mode (`--risky` / `config: global.risky_mode`): allows hard reset to upstream after creating a `git-rain-backup-*` ref.
+
+---
+
+## Testing
+
+- Run `make test-race` before considering a change done.
+- Prefer table-driven tests for multi-case functions.
+- Integration-style tests that shell out to `git` are preferred for `internal/git`.
+- Use `github.com/git-fire/git-testkit` helpers.
+
+---
+
+## Conventions
+
+- **No go-git**: all git interactions shell out to the system `git` binary.
+- **Cobra for CLI**: root command lives in `cmd/root.go`.
+- **Config via Viper/TOML**: user config at `~/.config/git-rain/config.toml`; env vars override.
+- **Error handling**: return errors up to the caller; only `log.Fatal`/`os.Exit` in `main.go`.

Makefile

@@ -0,0 +1,52 @@
+BINARY := git-rain
+ROOT := $(dir $(abspath $(lastword $(MAKEFILE_LIST))))
+REPO_BIN := $(ROOT)$(BINARY)
+USER_BIN := $(abspath $(HOME)/.local/bin)
+INSTALL_BIN := $(USER_BIN)/$(BINARY)
+VERSION ?= $(shell git -C "$(ROOT)" describe --tags --dirty 2>/dev/null || (cd "$(ROOT)" && go list -m -f '{{.Version}}' 2>/dev/null) || echo "dev")
+LDFLAGS := -X github.com/git-rain/git-rain/cmd.Version=$(VERSION)
+LDFLAGS_RELEASE := $(LDFLAGS) -s -w
+
+.PHONY: all build run test test-race lint clean install help
+
+all: build
+
+## build: compile binary next to this Makefile (./git-rain in repo root)
+build:
+	cd "$(ROOT)" && go build -ldflags "$(LDFLAGS)" -o "$(REPO_BIN)" .
+
+## run: build and run with optional ARGS (e.g. make run ARGS="--dry-run")
+run: build
+	"$(REPO_BIN)" $(ARGS)
+
+## test: run all tests
+test:
+	cd "$(ROOT)" && go test -count=1 ./...
+
+## test-race: run tests with race detector
+test-race:
+	cd "$(ROOT)" && go test -race -count=1 ./...
+
+## lint: vet the code
+lint:
+	cd "$(ROOT)" && go vet ./...
+
+## clean: remove the repo-local built binary
+clean:
+	rm -f "$(REPO_BIN)"
+
+## install: build and copy to ~/.local/bin (overwrites). Invoke from anywhere: make -C /path/to/git-rain install
+install:
+	@mkdir -p "$(USER_BIN)"
+	cd "$(ROOT)" && go build -ldflags "$(LDFLAGS_RELEASE)" -o "$(INSTALL_BIN)" .
+	@chmod 755 "$(INSTALL_BIN)"
+	@echo ""
+	@echo "Installed: $(INSTALL_BIN)"
+	@echo "This shell:  export PATH=\"$$HOME/.local/bin:$$PATH\" && hash -r"
+	@echo "   (zsh: use rehash instead of hash -r if needed)"
+	@echo "Permanent: add the export line to ~/.zshrc or ~/.bashrc"
+	@echo ""
+
+## help: show this help
+help:
+	@grep -E '^##' Makefile | sed 's/## /  /'