An adversarial audit of a live x402 agent storefront found 39 ways to take payment without delivering. None were payment bugs. Here are the four worst.