A developer uses Copilot CLI in a repository that has organization-approved hooks. Copilot proposes a command that would modify production infrastructure while fixing a deployment issue. The session stops before the command runs. Which option best explains the behaviour? Select one answer.

The correct answer is that a preToolUse hook escalated the command. The provided Policy decision clearly shows permissionDecision: "deny" for the terraform apply command, along with a permissionDecisionReason explaining why. This denial happened during the preToolUse event, meaning the hook intercepted the command before it could execute. The Result confirms this, stating "Tool execution blocked before bash command started." The other options are incorrect because they are not supported by the provided information. There's no indication that the Actions runner cannot locate Terraform; the command was blocked by policy, not execution failure. The repository's lack of deployment environment secrets is irrelevant here, as the command was not even attempted. Branch protection is also not applicable, as this is about a command being run by Copilot CLI, not a direct push to a branch.