no-panic

Attribute macro to require that the compiler prove a function can't ever panic.