Wrap concurrent code in Pony reference capabilities for data-race freedom