Fix with-contract so that contracts are only applied per mutation.

There's still a function application (here, a thunk) lurking in
external accesses, but since that's a trade-off for an entire contract
application, we profit.