Safer primitives for controlled signals

[Ralith]

Right now, defining a controlled signal always involves unsafe shared memory handling. We should explore ways to leverage the type system to reduce the hazards here, ideally without forcing additional layers of indirection. Maybe a pattern for safe inline shared-memory primitives could be developed based on newtyped references with private constructors and projection?