CI: macOS jobs will frustrate forkers

I had fun composing that title...

TL-DR: all MR from forks will fail on the macOS jobs.

We have macOS jobs in our CI runs. But they won't work on anyone else's fork. Later when they do work for everyone, there may be costs associated with those minutes or they may come from a smaller finite pool: so it seems rude to implicitly expect contributors to have those jobs run on your MR.

Maybe we can run none of the packaging stage unless we're on this repo? Or somehow filter out just those macOS jobs? Not sure how, but perhaps an environment variable I_CAN_HAZ_DEM_APPLES=1 set on the official repo...