Where do you check that capacity is nonzero? When capacity is zero, what happens on this line?

     a.capacity <<= 1u;

"all c code is unsafe" is not an excuse to permit bloody obvious, undocumented memory overruns.

I write a lot of c. Avoiding the unsafe bits, avoiding UB, is the skill required to write good c. "C code is unsafe" is a Rustacean marketing slogan. Don't believe it, but definitely don't practice it.