feat: formal verification suite — TLA+ specs for Raft, 2PC, MVCC, Replication

Verified with TLC model checker:
- Raft: 475k states, ElectionSafety + StateMachineSafety
- 2PC: 22k states, Atomicity + NoOrphanBlocks
- MVCC: 177k states, NoDirtyReads + ReadOwnWrites + WriteWriteConflict
- Replication: 3.6M states, MonotonicLsn + AcksRemovePending

formal-verification/models/raft.cfg

@@ -0,0 +1,15 @@
+CONSTANTS
+  Nodes = {n1, n2, n3}
+  Nil = Nil
+  MaxTerm = 3
+  MaxLogLen = 3
+
+INIT Init
+NEXT Next
+
+CHECK_DEADLOCK FALSE
+
+INVARIANTS
+  TypeOk
+  ElectionSafety
+  StateMachineSafety