refactor: paint-walk calls become shared borrows (painter slice 5)

The unsafe self-alias blocks existed only to mint *mut walk arguments;
paint_root_into takes &dyn WidgetHost now.

Co-Authored-By: Claude Fable 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01N4ajhvVZtyEEEus9bodsj3

 src/main.rs | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/src/main.rs b/src/main.rs
index 8ede6e5..1186707 100644
--- a/src/main.rs
+++ b/src/main.rs
@@ -420,10 +420,8 @@ impl Application for TextEditorApp {
 
         self.push_chrome_text(&mut pc);
 
-        let menu: *mut (dyn cce_ui::widget::WidgetHost + 'static) = self.menu_dropdown.as_ptr_mut();
-        let editor: *mut (dyn cce_ui::widget::WidgetHost + 'static) = self.editor.as_ptr_mut();
-        cce_ui::scene::painter::paint_root_into(&self.ui_context, menu, &mut pc);
-        cce_ui::scene::painter::paint_root_into(&self.ui_context, editor, &mut pc);
+        cce_ui::scene::painter::paint_root_into(&self.ui_context, &self.menu_dropdown, &mut pc);
+        cce_ui::scene::painter::paint_root_into(&self.ui_context, &self.editor, &mut pc);
 
         // The menu popover — geometry and labels last, on top of everything, exactly where
         // it hit-tests (the engine xdg popup is gone). Labels carry bounds equal to the