bank.withdraw uses checked_sub_lamports (#16848)