Agentic Backdoors via Pretraining Poisoning