Backdoored Agents Pass All Scans: VIDRAFT's ViKernel Blocks 290/290 `curl|bash` Payloads at Execution Time