* op-challenger: Fix run-trace disputed block selection

Previously it assumed the safe head at SafeL1 was before the safe head at HeadL1 in the sync status, but that is not guaranteed. As a result it could select an L2 block to check that was unsafe at the specified L1 head.

* op-challenger: Update vm-runner to handle the case where op-node hasn't processed all finalized L1 blocks yet