Personally, I do not recommend adding a deploy hook to cli.ini, as it will be in effect for ALL certificates. This is of course fine if you just have a few certs all requiring that specific hook, but often this is not the case.
I recommend adding the script to the --deploy-hook option on the command line. The reconfigure subcommand is almost done and is probably included in the next release of Certbot (I hope!), which should be 1.33.0 and 2.3.0. With that subcommand it's possible to reconfigure and thus add the deploy-hook command to any existing certificate without the need to force a renewal to do so.