verify the fail2ban defaults instead of recalling them

The previous commit hedged on the ban policy because I thought fail2ban was not
installed here. It is — the earlier ubuntu-setup run installed it — so the claim
could be checked rather than remembered.

Checked, and it was right: /etc/fail2ban/jail.d/defaults-debian.conf ships
`[sshd] enabled = true`, and the running jail reports maxretry 5, findtime 600,
bantime 600. This host has banned 6 addresses already.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

scripts/setup/machine-setup/lib/packages.sh

@@ -53,11 +53,13 @@ LAST_SKIPPED=()
 #
 # Two entries reach beyond simply existing on the machine.
 #
-# fail2ban is not a tool, it is a daemon: installing it starts it, and Debian and
-# Ubuntu ship an enabled sshd jail, so from that moment an address failing to log
-# in five times in ten minutes is blocked for ten. That is the point of it, and it
-# is worth having by default — but it is why it appears here rather than being
-# thought of as another binary. An existing install with its own jails is
+# fail2ban is not a tool, it is a daemon: installing it starts it, and Ubuntu
+# ships /etc/fail2ban/jail.d/defaults-debian.conf with `[sshd] enabled = true`.
+# Verified on this host — maxretry 5, findtime 600, bantime 600 — so from the
+# moment it installs, an address failing to log in five times in ten minutes is
+# blocked for ten, including yours. That is the point of it and it is worth
+# having by default, but it is why it belongs in this comment rather than being
+# thought of as one more binary. An existing install with its own jails is
 # untouched, because pkg_install never names a package that is already there.
 #
 # build-essential is the other: a meta-package (gcc, g++, make, libc6-dev,