Detect conventional package build and install hook files #194

Packages can run build or installation code through conventional files that are absent from their dependency manifests. git-pkgs/manifests#99 adds declared scripts to manifest parsing. Consumers also need file-based evidence from brief to identify potential install hooks in a package.

Brief already detects binding.gyp as node-gyp and extconf.rb as mkmf, but it does not expose a package-level inventory of potential hooks. build.rs appears in napi-rs configuration files, without general Cargo build-script detection. Other conventional hook files are missing from the current definitions.

Initial candidates:

Ruby's extconf.rb detection is also useful evidence, but installation depends on the gemspec's extensions declaration. Consumers should be able to join that declaration from manifests with the actual file found by brief.

Report the matched file path, ecosystem, package root and hook/build role in machine-readable output. Preserve conditions and distinguish file presence from confirmed execution. Nested packages need their own association, and glob matches should expose the actual paths. Existing scan exclusions and filesystem boundaries should apply; detection must not execute package code.

Reproduced with brief built from main at dddbfd2 (version: dev): create a package with a minimal Cargo.toml and sibling build.rs, then run brief <package-directory>. Cargo is detected, but the build script is absent from the report. A combined fixture also reported node-gyp and mkmf while omitting deps/build.jl, R's configure, pdm_build.py and a Conda recipe's build.sh.

Together, manifests' declared scripts and brief's file evidence would let downstream tooling list potential build/install hooks and explain where each finding came from. An empty result should not imply that a package cannot execute installation code.