refactor: switch slot 22 (DrawTiledTerrain) to native BlitBitmapClipped

`draw_tiled_terrain` was the last in-game caller of the asm bridge to
WA's `DisplayGfx::BlitBitmapClipped` (0x56A700). Slot 11's port already
had `blit_bitmap_clipped_native` doing the same clipping + dispatch
through `cbitmap_blit_via_wrapper`, so the bridge was redundant.

Verified the call site at 0x56C6A1: `EAX=this, EDX=col_width, stack
=(dst_x, dst_y, row_height, bitmap_ptr, flags)` maps cleanly to
`blit_bitmap_clipped_native(this, dst_x, dst_y, width, height,
surface, flags)`. Verified `TileBitmapSet::bitmap_ptrs[]` entries
share the CBitmap layout used by slot 11 by tracing FUN_00403c60's
`[ESI+0x4]` surface read against `CBitmap.surface`.

- Retypes `TileBitmapSet::bitmap_ptrs` from `*const u32` to
`*const *mut CBitmap`.
- Slot 22 now calls `blit_bitmap_clipped_native` directly.
- Deletes the `blit_bitmap_clipped` Rust wrapper and the
`blit_bitmap_clipped_bridge` naked-asm trampoline (~50 lines).
- Keeps `va::DISPLAY_GFX_BLIT_BITMAP_CLIPPED` because the slot-19
bitmap-sprite fallback path (`wa_blit_bitmap_clipped`) still
bridges to WA — that gets cleaned up by follow-up plan item 4.

Verification: cargo build clean, 15/15 headless replay tests pass,
headful napalm replay confirmed by user (no visual changes).

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

crates/openwa-core/src/render/display/gfx.rs

@@ -1,6 +1,7 @@
 use super::base::DisplayBase;
 use super::vtable::DisplayGfxVtable;
 use crate::bitgrid::DisplayBitGrid;
+use crate::render::sprite::sprite::CBitmap;
 use core::ffi::c_void;
 
 /// DisplayGfx — full display/graphics subsystem (derived from DisplayBase).
@@ -212,10 +213,15 @@ impl DisplayGfx {
 ///
 /// Pointed to by `DisplayGfx::tile_bitmap_sets`. Used by draw_tiled_terrain (slot 22)
 /// to iterate over bitmap tiles in a grid pattern.
+///
+/// Each `bitmap_ptrs[i]` is a [`CBitmap`] — the same struct slot 11's
+/// `bitmap_vec` uses. WA's BlitBitmapClipped (`0x56A700`) and the inner
+/// FUN_00403c60 read `+0x4` (the `surface` field) on every entry; the
+/// vtable+surface+pad layout matches.
 #[repr(C)]
 pub struct TileBitmapSet {
     /// 0x00: Bitmap count or total size (observed values: 0x168 = 360)
     pub count: u32,
-    /// 0x04: Pointer to array of bitmap pointers (one per grid tile, row-major order)
-    pub bitmap_ptrs: *const u32,
+    /// 0x04: Pointer to array of CBitmap pointers (one per grid tile, row-major).
+    pub bitmap_ptrs: *const *mut CBitmap,
 }

crates/openwa-core/src/render/display/vtable.rs

@@ -1126,11 +1126,11 @@ pub unsafe extern "thiscall" fn draw_tiled_terrain(
 
             let bitmap_ptr = *bitmap_array.add(bitmap_idx as usize);
 
-            blit_bitmap_clipped(
+            blit_bitmap_clipped_native(
                 this,
-                col_w,
                 pixel_x + x_offset,
                 pixel_y + y_offset,
+                col_w,
                 row_h,
                 bitmap_ptr,
                 blit_flags,
@@ -1144,59 +1144,6 @@ pub unsafe extern "thiscall" fn draw_tiled_terrain(
     }
 }
 
-/// Bridge to DisplayGfx__BlitBitmapClipped (0x56A700).
-///
-/// Usercall: EAX=this (DisplayGfx*), EDX=col_width, 5 stack params (dst_x, dst_y,
-/// row_height, bitmap_ptr, flags), RET 0x14.
-///
-/// Clips the bitmap rectangle against the display clip rect, calls flush_render_lock,
-/// then delegates to the low-level blit function (0x403C60).
-unsafe fn blit_bitmap_clipped(
-    gfx: *mut DisplayGfx,
-    col_width: i32,
-    dst_x: i32,
-    dst_y: i32,
-    row_height: i32,
-    bitmap_ptr: u32,
-    flags: u32,
-) {
-    blit_bitmap_clipped_bridge(
-        gfx as u32,
-        col_width as u32,
-        dst_x as u32,
-        dst_y as u32,
-        row_height as u32,
-        bitmap_ptr,
-        flags,
-        rb(va::DISPLAY_GFX_BLIT_BITMAP_CLIPPED),
-    );
-}
-
-/// Naked bridge: sets EAX=this, EDX=col_width, pushes 5 stack params, calls target.
-#[unsafe(naked)]
-unsafe extern "cdecl" fn blit_bitmap_clipped_bridge(
-    _this: u32,
-    _col_width: u32,
-    _dst_x: u32,
-    _dst_y: u32,
-    _row_height: u32,
-    _bitmap_ptr: u32,
-    _flags: u32,
-    _target: u32,
-) {
-    core::arch::naked_asm!(
-        "mov eax, [esp + 4]", // EAX = this
-        "mov edx, [esp + 8]", // EDX = col_width
-        "push [esp + 28]",    // flags
-        "push [esp + 28]",    // bitmap_ptr (shifted by our push)
-        "push [esp + 28]",    // row_height
-        "push [esp + 28]",    // dst_y
-        "push [esp + 28]",    // dst_x
-        "call [esp + 52]",    // target (offset: 5 pushes × 4 + 32 original)
-        "ret",
-    );
-}
-
 /// Port of DisplayGfx::DrawPixelStrip (vtable slot 15, 0x56BE10).
 ///
 /// Draws `count + 1` pixels starting at (x, y), stepping by (dx, dy) each
@@ -2764,12 +2711,11 @@ unsafe fn cbitmap_blit_via_wrapper(
 /// render lock if held, and dispatches the actual blit through
 /// `cbitmap_blit_via_wrapper`.
 ///
-/// The original WA function still exists and is called by other slots
-/// (`DrawTiledTerrain`, `BlitBitmapTiled_Maybe`); we don't replace it
-/// in-place. This Rust version is only used by our ported slot 11.
-/// (The earlier `blit_bitmap_clipped` in this file is the asm bridge to
-/// the original WA function used by slot 22 — kept until it has a typed
-/// caller to validate against.)
+/// Used by ported slots 11 (`DrawTiledBitmap`) and 22 (`DrawTiledTerrain`).
+/// The original WA function at `0x56A700` still exists and is called by
+/// the slot-19 bitmap-sprite fallback path (`wa_blit_bitmap_clipped`) —
+/// see follow-up plan item 4. The address constant
+/// `DISPLAY_GFX_BLIT_BITMAP_CLIPPED` is kept until that path is ported.
 ///
 /// # Safety
 /// `this` must be a valid `*mut DisplayGfx`. `surface` must be a valid