When Refusals Fail: Unstable Safety Mechanisms in Long-Context LLM Agents