fix(paint): include box-shadow and descendant ink in the layer bounds

[LeadcodeDev]

Severity High, category correctness. Location: crates/rustmotion-core/src/engine/paint_pass.rs:390

Impact

bleed is derived only from node.css.filter (FilterFn::Blur / DropShadow in filter_bleed, line 610). It ignores the node's own box_shadow, which step 5 paints inside this layer (line 411-418) at layout.x + dx - spread, width + spread*2 — i.e. outside the border-box — and it ignores the whole subtree painted at steps 9-10, which with the default overflow: visible may legitimately extend past the parent box (absolutely-positioned children, a child's own scale/pulse transform, a child glow, marquee, which CLAUDE.md explicitly documents as "exempté (leur rôle est de bleed)"). The file's own comment on filter_bleed (line 605-609) states the rule: "a too-tight one would silently clip filter bleed, trading a perf bug for a correctness one". Concretely: a card with box-shadow: 0 20px 40px rgba(0,0,0,.5) loses its shadow the moment any fade_in drives opacity below 1.0, and regains it on the frame opacity reaches 1.0 — a visible pop mid-entrance. The repo already treats this exact invariant as load-bearing for overflow: hidden (test overflow_hidden_does_not_clip_own_outset_box_shadow, line 2909); the opacity layer violates it for the same shadow.

Fix

Compute the layer bounds from the union of: the border-box, the filter bleed, the outset box_shadow extents (|offset| + blur*1.5 + spread per shadow), and — when overflow is visible — the descendants' layout union. Alternatively move the outset box-shadow painting outside the opacity layer and multiply its paint alpha by opacity, and fall back to an unbounded layer when overflow: visible and children exist.

Evidence the audit read

let bleed = node
            .css
            .filter
            .as_deref()
            .map(|list| filter_bleed(list, &length_ctx))
            .unwrap_or(0.0);
        let bounds = Rect::from_xywh(
            box_layout.x - bleed,
            box_layout.y - bleed,
            box_layout.width + bleed * 2.0,
            box_layout.height + bleed * 2.0,
        );

Based directly on the chantier branch.

Part of the September 2026 audit remediation chantier. Refs #220 (RM-01).