add two lines in HACKING guide

- You should NEVER commit directly to the upstream repo.