Detect conventional package build and install hook files

[andrew]

Packages can run build or installation code through conventional files that are absent from their dependency manifests. git-pkgs/manifests#99 adds declared scripts to manifest parsing. Consumers also need file-based evidence from brief to identify potential install hooks in a package.

Brief already detects binding.gyp as node-gyp and extconf.rb as mkmf, but it does not expose a package-level inventory of potential hooks. build.rs appears in napi-rs configuration files, without general Cargo build-script detection. Other conventional hook files are missing from the current definitions.

Initial candidates:

Ecosystem	Files and behavior
Cargo	build.rs, automatically detected unless disabled or replaced by package.build. Reference
npm	binding.gyp, which can supply node-gyp rebuild as the default install hook. Explicit install / preinstall scripts and gypfile: false affect this behavior. Reference
Julia	deps/build.jl, the package build script. Reference
R	configure, configure.win, cleanup scripts and src/Makevars, including platform variants. Reference
Python	pdm_build.py, automatically discovered by PDM's build backend; setup.py is another executable build entrypoint already recognized by brief. PDM reference
Conda	Recipe-local build.sh and bld.bat. Reference
NuGet	Legacy package tools/install.ps1 and tools/uninstall.ps1; PackageReference does not execute these install/uninstall scripts. Reference

Ruby's extconf.rb detection is also useful evidence, but installation depends on the gemspec's extensions declaration. Consumers should be able to join that declaration from manifests with the actual file found by brief.

Report the matched file path, ecosystem, package root and hook/build role in machine-readable output. Preserve conditions and distinguish file presence from confirmed execution. Nested packages need their own association, and glob matches should expose the actual paths. Existing scan exclusions and filesystem boundaries should apply; detection must not execute package code.

Reproduced with brief built from main at dddbfd2 (version: dev): create a package with a minimal Cargo.toml and sibling build.rs, then run brief <package-directory>. Cargo is detected, but the build script is absent from the report. A combined fixture also reported node-gyp and mkmf while omitting deps/build.jl, R's configure, pdm_build.py and a Conda recipe's build.sh.

Together, manifests' declared scripts and brief's file evidence would let downstream tooling list potential build/install hooks and explain where each finding came from. An empty result should not imply that a package cannot execute installation code.

[andrew]

The manifests side landed: git-pkgs/manifests#100 merged, adding declared lifecycle scripts to manifest parsing. The latest manifests release v0.12.2 predates that merge, so joining declared scripts with brief's file evidence unblocks once manifests cuts a release and brief bumps the dependency.