[BUG] use CacheContext in handler_withdraw to prevent accidental commits on error

Related to #1299 (closed)

This fixes a class of bugs we've been hit with in withdraw: failing to restore state on errors, which ends up accidentally committing changes since the deposit handler ignores internal handler errors.

Instead of adding one more band-aid, I'm introducing a new approach: CacheContext. If we like this, I want to move this up a layer and have it run on all internal handlers to prevent similar issues.