AGENTS.md Poisoning: Why Your Downloads Folder Is a Security Boundary for Coding Agents