See discussion in Q56: Herald "Commit hooks" are being run even for commits that won't be published, which is confusing.
Technically, that's because "commit hooks" aren't actually Herald rules - they share UI, but are implemented in a different place..