Strengthen JobProtocol model after independent review.

Replace tautological invariants with non-trivial ones, allow multi-shot
coordination loss and re-partition, fix reap/progress lifecycle, enable
deadlock checking via Done, and add stress and multi-shot TLC configs.

docs/protocol/RemoraCombined.cfg

@@ -1,10 +1,12 @@
 SPECIFICATION SafetySpec
 
-CHECK_DEADLOCK FALSE
+CHECK_DEADLOCK TRUE
 
 \* Combined contention: both local and deployment-wide limits constrain work.
+\* Shrunk from 3 jobs to 2 so TLC finishes in minutes; Local=1 and Global=2
+\* still force both limiters to bind under two live workers.
 CONSTANTS
-    Jobs = {j1, j2, j3}
+    Jobs = {j1, j2}
     Workers = {w1, w2}
     InitialWorkers = {w1, w2}
     NoJob = NoJob
@@ -16,19 +18,21 @@ CONSTANTS
     GlobalLimit = 2
     FaultsEnabled = FALSE
     FaultServices = {}
+    MaxCoordLosses = 0
+    MaxPartitions = 0
 
 INVARIANTS
     TypeOK
     StateConsistency
-    AtMostOneAuthoritativeAttempt
-    FencingTokensUnique
+    AllocatedTokensUsed
+    LiveProgressAligned
+    AtMostOneLiveLeasePerJob
+    AuthorityWellFormed
     CommittedResultConsistent
     CancellationSafety
     PermitSafety
-    QueueRecoverable
-    AttemptIsolation
     ResumeValidity
-    ZombieIsolation
+    StagingOwnership
 
 PROPERTIES
     TerminalStateIsImmutable