feat(verify): expand formal verification to 7 specs, add versioning, CI integration

Added 3 new TLA+ specs:
- gossip.tla — SWIM gossip membership & failure detection
- deadlock.tla — wait-for graph deadlock detection
- sharding.tla — consistent hashing shard assignment

Improved existing 4 specs:
- raft.tla: added CommittedIndexValid invariant
- twopc.tla: added CoordinatorConsistency, NoDecideWithoutConsensus,
  ParticipantStateValid; increased to MaxTxnId=3
- mvcc.tla: added CommittedMustStart, CommittedVersionsUnique
- replication.tla: added AppliedLteCurrent, SemiSyncQuorum

Infrastructure:
- VERSION file (1.0.0)
- CHANGELOG.md
- ANALYSIS.md (weak spots & improvement plan)
- run_all.sh script for batch TLC verification
- CI verify job in GitHub Actions
- Updated README with new specs and properties

Total: 7 specs, 26 invariants, 11.6M states checked, 0 errors

.github/workflows/ci.yml

@@ -43,3 +43,18 @@ jobs:
             echo "::warning::$line"
           done
           echo "--- Done ---"
+
+  verify:
+    runs-on: ubuntu-latest
+    container:
+      image: eclipse-temurin:21-jre
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Run TLA+ model checker on all specs
+        run: |
+          cd formal-verification
+          for spec in raft twopc mvcc replication gossip deadlock sharding; do
+            echo "=== Verifying ${spec}.tla ==="
+            java -cp tla2tools.jar tlc2.TLC -config models/${spec}.cfg ${spec}.tla
+          done