Add E2E story coverage for the fail2ban action family

The fail2ban action family has no end-to-end story. `ConfigureFail2banJail`, `Fail2banBanIp`, `Fail2banUnbanIp` and `Fail2banStatus` are all absent from `tests/e2e/stories/`, and `grep -li fail2ban tests/e2e/stories/` returns nothing.

The construction path is well covered: `crates/sysknife-daemon/src/actions/fail2ban.rs` carries 20 unit tests, including the `IpAddr::from_str` validation that rejects a malformed address before the `ActionSpec` is built. What is missing is the other half, proof that the planner selects these actions from a natural-language intent on a real Ubuntu host.

## Why it is worth doing

fail2ban is a security action family, so the planner picking the wrong action here has a sharper cost than a mislabelled disk query. A story like "ban 203.0.113.7 in the sshd jail" exercises the whole chain: intent to `Fail2banBanIp` with the right jail and IP params, the daemon's validation, and the approval gate. That is exactly what the E2E suite exists to catch and what unit tests cannot.

## Scope

Add stories under `tests/e2e/stories/`, following the existing header convention (`# Story (ubuntu, ): `, where the risk tag is `read-only`, `medium-risk` or `high-risk`, as in `story-101.sh` and `story-102.sh`) and the pattern in the neighbouring Debian-only stories:

- `Fail2banStatus`: a read-only "is fail2ban running" intent (Observer).
- `ConfigureFail2banJail`: enable a jail (mutating, needs approval).
- `Fail2banBanIp` / `Fail2banUnbanIp`: ban and unban a specific address in a named jail.

Record and replay them on Ubuntu the same way the current 79 stories run: `UBUNTU_RELEASE=noble ./tests/e2e/ubuntu-vm.sh` for the live pass, then commit the cassette and its replay twin so the suite still runs offline.

Start with `Fail2banStatus` alone if you want a smaller first PR. One read-only story is a complete, mergeable change.

## Difficulty

`medium`. The harness and the pattern exist; the work is writing the intents and recording a clean pass.

## Getting started

[CONTRIBUTING.md](https://github.com/lacs-project/sysknife/blob/main/CONTRIBUTING.md) has the build and test commands, and the E2E section covers the VM harness. No CLA and no copyright waiver. The project is MIT.