A first implementation of safe/safeWith

Not quite done yet. Two flaws:

 - Can only check safety for functions that end-up returning an SBool
result. This is rather limited.

 - The call simply prints the model if one is found; there’s gotta be a
better return type for programmatic usage.