Fix zero-detection loop panic on non-block-aligned writes

Prevents index-out-of-range panic in WriteAtWithoutLock when buffer
length is not a multiple of blockSize by computing the actual slice
end for each block iteration.

Author: cursoragent

packages/orchestrator/pkg/sandbox/block/cache.go

@@ -348,7 +348,8 @@ func (c *Cache) WriteAtWithoutLock(b []byte, off int64) (int, error) {
 	// detect-zeroes=unmap: route aligned all-zero blocks to Empty.
 	for i := off; i < end; i += c.blockSize {
 		idx := uint32(header.BlockIdx(i, c.blockSize))
-		if header.IsZero(b[i-off : i-off+c.blockSize]) {
+		blockEnd := min(i-off+c.blockSize, int64(len(b)))
+		if header.IsZero(b[i-off : blockEnd]) {
 			c.punchHole(i, c.blockSize)
 			c.tracker.SetRange(idx, idx+1, Zero)
 		} else {