#9054 fix(byok): preserve credential ownership on lookup failures

Summary

A failed BYOK database lookup could be treated as an absent key, allowing a request to run and be billed with a platform credential. The shared resolver now returns null only after successfully confirming that no eligible customer key applies. Lookup failures and unusable configured key pools stop execution.

Transient database reads use the existing error classifier, jittered backoff, and deadline helpers: at most three attempts within five seconds, with caller cancellation propagated. Tool execution no longer swallows credential failures. Copilot's enterprise gate uses the billing layer's existing strict-read policy so an unavailable subscription lookup cannot bypass BYOK.

Type of Change

• Bug fix

Testing

• Seven real-Postgres regressions cover a terminated connection and recovery, exhausted retries, permanent query errors, corrupt ciphertext, confirmed absence, and organization/personal entitlement read failures. Reverting each safeguard makes its regression fail.
• Focused tests cover cancellation, late database results, and stopping tool dispatch and metering after credential failure.
• Workspace type checks, test-type ratchet, lint, all 60 audits, and the staging-sensitive block registry check pass.
• Full repository gate passes: 606 script tests, 37,711 app tests (7 skipped), and all 20 workspace tasks. Ran with bun run test --concurrency=2 -- --maxWorkers=4.

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced