should destroy!false be @system?

[kinke]

I think it's clear that `destroy!false` should be `@system`. - 
Wrt. `__xdtor` (the *full* dtor, destructing the fields too, so 
might be `@system` even if the user dtor itself is `@safe), that 
would probably be ideally disallowed by the compiler as well, and 
ctors probably too (as they usually operate on the assumption 
that the payload is initialized to its `.init` value). But that's 
IMO way more exotic, and anything with two leading underscores in 
an `@safe` scope quite suspicious.