Agents Hit the Trust Boundary: Storm-3168, OpenAI's Scope Drift, and Traces Agents Can Delete