ci: Move macos snippet under DANGER_RUN_CI_ON_HOST

This move-only refactor clarifies that macos assumes and requires
DANGER_RUN_CI_ON_HOST.

So move the snippet under the condition for self-documenting code.

Can be reviewed with the git options:
--color-moved=dimmed-zebra --color-moved-ws=ignore-all-space

ci/test/02_run_container.py

@@ -59,6 +59,14 @@ def main():
 
         # Modify PATH to prepend the retry script, needed for CI_RETRY_EXE
         os.environ["PATH"] = f"{os.environ['BASE_ROOT_DIR']}/ci/retry:{os.environ['PATH']}"
+        # GNU getopt is required for the CI_RETRY_EXE script
+        if os.getenv("CI_OS_NAME") == "macos":
+            prefix = run(
+                ["brew", "--prefix", "gnu-getopt"],
+                stdout=subprocess.PIPE,
+                text=True,
+            ).stdout.strip()
+            os.environ["IN_GETOPT_BIN"] = f"{prefix}/bin/getopt"
     else:
         CI_IMAGE_LABEL = "bitcoin-ci-test"
 
@@ -156,15 +164,6 @@ def main():
         ).stdout.strip()
         os.environ["CI_CONTAINER_ID"] = container_id
 
-    # GNU getopt is required for the CI_RETRY_EXE script
-    if os.getenv("CI_OS_NAME") == "macos":
-        prefix = run(
-            ["brew", "--prefix", "gnu-getopt"],
-            stdout=subprocess.PIPE,
-            text=True,
-        ).stdout.strip()
-        os.environ["IN_GETOPT_BIN"] = f"{prefix}/bin/getopt"
-
     run(["./ci/test/02_run_container.sh"])  # run the remainder
     if not os.getenv("DANGER_RUN_CI_ON_HOST"):
         print("Stop and remove CI container by ID")