At a previous job, we had a locked down "central" server (I know, central server for a distributed RCS sounds funny) that didn't allow direct login except by admins. Users could only clone / pull from it. Admins did the pushing. I'm not sure if hooks were used, but we sent automated emails and accomplished the permissions using the hgadmin tools.
If you set this up you could install your own hooks on that machine (see http://hgbook.red-bean.com/read/handling-repository-events-with-hooks.html) to perform the actions you're talking about - accept pushes that pass the tests, run a build script, and a copy it out if everything goes according to plan (see the changegroup hook).
Or you could install some continuous integration software on your server, but you'll end up paying for that. We're about to start using Bamboo by Jira (see http://www.atlassian.com/software/bamboo/overview - they do have a free trial), but I can't speak for any at the moment.