SoK: Measuring What Matters for Closed-Loop Security Agents