What nearly 10,000 developer environments reveal about agentic development risk