https://djugei.github.io/bad-at-unsafe/ describes an error a user had when trying to use offset:

> At first I just assumed that the .add() and .offset() methods on pointers would mutate the pointer. They do not. Instead they return a new pointer, which gets dropped silently if you don't use it. Unlike for example Result, which is must_use annotated.

…sfackler

make offset must_use

https://djugei.github.io/bad-at-unsafe/ describes an error a user had when trying to use offset:

> At first I just assumed that the .add() and .offset() methods on pointers would mutate the pointer. They do not. Instead they return a new pointer, which gets dropped silently if you don't use it. Unlike for example Result, which is must_use annotated.

This PR only adds `offset`, because I wanted to float the idea; I'm imagining that there's more than just `add` and `offset` that could use this. I am also very open to re-wording the warning.

r? @rust-lang/libs

Cleanup and document `-C code-model`

r? @Amanieu

…ulacrum

abort_internal is safe

`sys::abort_internal` is stably exposed as a safe function. Forward that assumption "inwards" to the `sys` module by making the function itself safe, too.

This corresponds to what rust-lang#72204 did for the intrinsic. We should probably wait until that lands because some of the intrinsic calls in this PR might then need adjustments.