`appender(s)` is safe if `s` is mutable, but allows clobbering immutable data if `s` is immutable.

This is bad and wrong because:
- a safe and unsafe operation is behind the same function signature, meaning it's easy for templated code to accidentally lead to immutable data corruption
- it should not hide an unsafe operation behind such an innocent-looking call - it should either force the user to add a cast at the call site, or clearly indicate a dangerous operation in its name (e.g. as `assumeSafeAppend` and `assumeUnique` do).