Then there is the check that works perfectly and gets walked round.
No bypass
The rule that nobody gets past a check by switching it off: skipping the hook, silencing the error, deleting the failing test. An agent may try any of these, so the rule has to be held by something that can see them, and not by asking.
A person knows --no-verify is cheating. An agent told to make the checks pass can see removing the check as a solution, and can then truthfully report that everything is green. A line asking it not to is only a guide. You need something on a machine it can't edit, looking at what changed.
Say it to your agent
“Add a CI step that reads git diff origin/main...HEAD and fails if a test file was deleted, if the diff adds .skip(, .only(, @ts-ignore or @ts-nocheck, or if it touches tsconfig.json or .github/workflows/, unless the pull request has the label harness-change. Add a PreToolUse hook that blocks --no-verify. Show me each one refusing.”