feat: formal verification suite — TLA+ specs for Raft, 2PC, MVCC, Replication

Verified with TLC model checker:
- Raft: 475k states, ElectionSafety + StateMachineSafety
- 2PC: 22k states, Atomicity + NoOrphanBlocks
- MVCC: 177k states, NoDirtyReads + ReadOwnWrites + WriteWriteConflict
- Replication: 3.6M states, MonotonicLsn + AcksRemovePending

formal-verification/models/mvcc.cfg

@@ -0,0 +1,16 @@
+CONSTANTS
+  Keys = {k1, k2}
+  Values = {v1, v2}
+  Nil = Nil
+  MaxTxnId = 2
+
+INIT Init
+NEXT Next
+
+CHECK_DEADLOCK FALSE
+
+INVARIANTS
+  TypeOk
+  NoDirtyReads
+  ReadOwnWrites
+  WriteWriteConflict