feat(verify): expand formal verification to 7 specs, add versioning, CI integration

Added 3 new TLA+ specs:
- gossip.tla — SWIM gossip membership & failure detection
- deadlock.tla — wait-for graph deadlock detection
- sharding.tla — consistent hashing shard assignment

Improved existing 4 specs:
- raft.tla: added CommittedIndexValid invariant
- twopc.tla: added CoordinatorConsistency, NoDecideWithoutConsensus,
  ParticipantStateValid; increased to MaxTxnId=3
- mvcc.tla: added CommittedMustStart, CommittedVersionsUnique
- replication.tla: added AppliedLteCurrent, SemiSyncQuorum

Infrastructure:
- VERSION file (1.0.0)
- CHANGELOG.md
- ANALYSIS.md (weak spots & improvement plan)
- run_all.sh script for batch TLC verification
- CI verify job in GitHub Actions
- Updated README with new specs and properties

Total: 7 specs, 26 invariants, 11.6M states checked, 0 errors

formal-verification/models/twopc.cfg

@@ -1,7 +1,7 @@
 CONSTANTS
   Participants = {p1, p2, p3}
   Nil = Nil
-  MaxTxnId = 2
+  MaxTxnId = 3
 
 INIT Init
 NEXT Next
@@ -12,3 +12,6 @@ INVARIANTS
   TypeOk
   Atomicity
   NoOrphanBlocks
+  CoordinatorConsistency
+  NoDecideWithoutConsensus
+  ParticipantStateValid