Function apply_npm_manifest_env 

pub fn apply_npm_manifest_env(
    cmd: &mut Command,
    manifest: &PackageJson,
    script_dir: &Path,
    lifecycle_script: &str,
)

Apply the manifest-derived npm_package_* env (name, version, absolute npm_package_json path, and the deep-flattened engines/config/bin) plus npm_lifecycle_script (the raw script body) to a lifecycle or aube run command. Call last so the values land after any jail env_clear. script_dir is the directory the script runs in, whose package.json is the manifest being executed; lifecycle_script is the raw script body exported as npm_lifecycle_script.

pnpm rebuilds the npm_package_* namespace per package: it drops every inherited npm_package_* key and stamps only the running manifest’s allowlist. We mirror that — scrub first, then re-stamp — so a script never sees a parent/sibling package’s fields (verified against pnpm 11.5). Without the scrub, non-allowlisted inherited keys (e.g. an outer npm run’s npm_package_description) would leak through on the unjailed path and break allowlist parity. On the jailed path the prior env_clear already dropped them, so the scrub is a harmless no-op there.