add todo item about hooks not called during untrusted git push