Also renames fields `IsLastInSpan` to `Safe` because that's semantically
clearer. That a last batch in a span batch is pre-Holocene the indicator
for a safe block promotion is an implementation detail. It's better to
name the effect rather than the reason.