prefetch-npm-deps runs in the deps fetcher's buildPhase and checks for package-lock.json at CWD (repo root). postPatch runs in both the fetcher and the main build, so we copy the lock file there. The main build then cds into the subdir in buildPhase. npmDepsHash values remain placeholders (lib.fakeHash).