Markdown Is the New Executable: What the AGENTS.md-in-Downloads Attack Teaches Us About Coding Agent Security