When the AI You’re Testing Starts Testing You: What the OpenAI–Hugging Face Incident Means for Anyone Running Agents