Fix flush to use BlockCeilIdx for end boundary

Changed the flush closure in WriteAtWithoutLock to use BlockCeilIdx instead
of BlockIdx for the end boundary calculation. This makes it consistent with
setIsCached, isCached, and WriteZeroesAt functions, preventing edge cases
where non-block-aligned end offsets could cause the tracker to miss the
final partial block while still operating on it with punchHole or copy.

Author: cursoragent

packages/orchestrator/pkg/sandbox/block/cache.go

@@ -350,7 +350,7 @@ func (c *Cache) WriteAtWithoutLock(b []byte, off int64) (int, error) {
 	// same-state run as a single bulk copy / punchHole / SetRange.
 	flush := func(runStart, runEnd int64, runZero bool) {
 		startIdx := uint32(header.BlockIdx(runStart, c.blockSize))
-		endIdx := uint32(header.BlockIdx(runEnd, c.blockSize))
+		endIdx := uint32(header.BlockCeilIdx(runEnd, c.blockSize))
 		if runZero {
 			c.punchHole(runStart, runEnd-runStart)
 			c.tracker.SetRange(startIdx, endIdx, Zero)