test(orch): cover the memfd identity-offset source

Assert MemfdIdentitySource serves dirty pages from the memfd at identity offsets
while mapped, and reports BytesNotAvailableError once the memfd is released.

Signed-off-by: Nikita Kalyazin <nikita.kalyazin@e2b.dev>
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: kalyazin

packages/orchestrator/pkg/sandbox/block/memfd_test.go

@@ -395,3 +395,31 @@ func TestDedupedMemfdCache_InflightConcurrentDrainRace(t *testing.T) {
 	default:
 	}
 }
+
+// MemfdIdentitySource serves dirty pages from the memfd at identity offsets
+// while it is mapped, and reports BytesNotAvailableError once it is released so
+// the caller falls back to the drained cache (via the swapped-in deduped header).
+func TestMemfdIdentitySource_ServesThenReleases(t *testing.T) {
+	t.Parallel()
+
+	ps := int64(header.PageSize)
+	memfd, data := newTestMemfd(t, ps*4)
+	d := &DedupedMemfdCache{done: utils.NewSetOnce[*Cache](), memfd: memfd}
+	src := NewMemfdIdentitySource(d, ps*4)
+
+	for _, page := range []int64{0, 2, 3} {
+		b := make([]byte, ps)
+		n, err := src.ReadAt(b, page*ps)
+		require.NoError(t, err)
+		require.Equal(t, int(ps), n)
+		require.Equal(t, data[page*ps:(page+1)*ps], b)
+	}
+	require.True(t, src.IsCached(t.Context(), 0, ps*4))
+
+	require.NoError(t, d.releaseMemfd())
+
+	_, err := src.ReadAt(make([]byte, ps), 0)
+	var bna BytesNotAvailableError
+	require.ErrorAs(t, err, &bna)
+	require.False(t, src.IsCached(t.Context(), 0, ps))
+}