Function run_dep_hook 

pub async fn run_dep_hook(
    package_dir: &Path,
    dep_modules_dir: &Path,
    project_root: &Path,
    modules_dir_name: &str,
    manifest: &PackageJson,
    hook: LifecycleHook,
    tool_bin_dirs: &[&Path],
    jail: Option<&ScriptJail>,
) -> Result<bool, Error>

Run a lifecycle hook against an installed dependency’s package directory. Mirrors run_root_hook but spawns inside package_dir (the actual linked package directory, e.g. node_modules/.aube/<dep_path>/node_modules/<name>). The manifest is the dependency’s own package.json, not the project root’s.

dep_modules_dir is the dep’s sibling node_modules/ — i.e. package_dir’s parent for unscoped packages, or package_dir’s grandparent for scoped (@scope/name). <dep_modules_dir>/.bin is prepended to PATH so the dep’s postinstall can spawn tools declared in its own dependencies (the transitive-bin case — prebuild-install, node-gyp, napi-postinstall). The install driver writes shims there via link_dep_bins; rebuild mirrors the same pass.

For the install hook specifically, if the manifest leaves both install and preinstall empty but the package has a top-level binding.gyp, this falls back to running node-gyp rebuild — the node-gyp default that npm and pnpm both honor so native modules without a prebuilt binary still compile on install.

tool_bin_dirs are prepended to PATH after the dep’s own .bin so that aube-bootstrapped tools (e.g. node-gyp) fill the gap for deps that shell out to them without declaring them as their own dependencies. The dep’s local bin still wins if it shipped its own copy.

The caller is responsible for gating on BuildPolicy and --ignore-scripts. Returns Ok(false) if the hook wasn’t defined.