Verify each finding against the current code and only fix it if needed.

In `@svc/api/run.go` around lines 176 - 190, Extract the duplicated callback logic
for FindKeyCredits and DecrementKeyCredits into a single shared helper (e.g., a
new package or helper file exposing functions named FindKeyCredits(ctx, keyID
string) (int32, bool, error) and DecrementKeyCredits(ctx, keyID string, cost
int32) error) that internally uses db.WithRetryContext for reads and
db.Query.UpdateKeyCreditsDecrement for writes; then replace the inline callbacks
in run.go, testutil/http.go, sentinel/run.go and any integration tests to call
these shared helpers so the retry/read and non-idempotent write behavior is
centralized and not duplicated.