Mastercard, Visa, and Stripe just rebuilt payments for AI agents. But when your agent buys something you didn't sanction, Regulation E has no clear answer.