When Robots Obey the Patch: Universal Transferable Patch Attacks on Vision-Language-Action Models