`init()` intrinsic is unsafe

The `init()` intrinsic seems to fill data with zeros.  It's convenient.  But it's unsafe as written!  It should either be limited to POD types (via a new kind) or else designated unsafe.

I also think there should be an (unsafe) `uninit()` intrinsic (#3471).
