What is better enforced by an automated check than by asking the agent?

Things that can be checked unambiguously: type checking, formatting, important tests and detecting some secrets. The instruction “always check the tests” is an expectation. The actual output of a command is evidence, and CI, i.e. automatically checking each code change, can block merging a broken change. GitHub Actions lets you run such tests, as well as build and deploy the app, after certain repository events.

A hook is a mechanism that runs on a specific tool event. It can help with control, but you need to know its real blocking rules. The scripts and CI configuration themselves need protecting too. An agent could weaken a test to “fix” it. So a review also covers changes to assertions and configuration. Green checks don't cover requirements nobody wrote down.