Function run_dep_hook 

pub async fn run_dep_hook(
    package_dir: &Path,
    dep_modules_dir: &Path,
    project_root: &Path,
    modules_dir_name: &str,
    manifest: &PackageJson,
    hook: LifecycleHook,
) -> Result<bool, Error>

Run a lifecycle hook against an installed dependency’s package directory. Mirrors run_root_hook but spawns inside package_dir (the actual linked package directory, e.g. node_modules/.aube/<dep_path>/node_modules/<name>). The manifest is the dependency’s own package.json, not the project root’s.

dep_modules_dir is the dep’s sibling node_modules/ — i.e. package_dir’s parent for unscoped packages, or package_dir’s grandparent for scoped (@scope/name). <dep_modules_dir>/.bin is prepended to PATH so the dep’s postinstall can spawn tools declared in its own dependencies (the transitive-bin case — prebuild-install, node-gyp, napi-postinstall). The install driver writes shims there via link_dep_bins; rebuild mirrors the same pass.

For the install hook specifically, if the manifest leaves both install and preinstall empty but the package has a top-level binding.gyp, this falls back to running node-gyp rebuild — the node-gyp default that npm and pnpm both honor so native modules without a prebuilt binary still compile on install.

The caller is responsible for gating on BuildPolicy and --ignore-scripts. Returns Ok(false) if the hook wasn’t defined.