Governed, Verified, and Still Wrong: Where Cortex Agents Break in Real Conversations