When we need to hardlink a dependency (because it has peer deps that need to be controlled), it's better to only consider its NPM-published files. This avoids traversing potentially massive amounts of unpublished files (including node_modules directories that are nested beneath the package in places other than the default one).