Strengthen JobProtocol model after independent review.

Replace tautological invariants with non-trivial ones, allow multi-shot
coordination loss and re-partition, fix reap/progress lifecycle, enable
deadlock checking via Done, and add stress and multi-shot TLC configs.

docs/protocol/RemoraStress.cfg

@@ -0,0 +1,40 @@
+SPECIFICATION SafetySpec
+
+CHECK_DEADLOCK TRUE
+
+\* Stress envelope: MaxProgress=2 (partial resume), MaxAttempts=2 (retry),
+\* multi-service faults (Coordination+Durable), single-shot fault budgets.
+\* Deeper multi-shot budgets live in Remora.cfg; deeper MaxAttempts in RemoraFencing.
+CONSTANTS
+    Jobs = {j1}
+    Workers = {w1, w2}
+    InitialWorkers = {w1}
+    NoJob = NoJob
+    NoWorker = NoWorker
+    MaxAttempts = 2
+    MaxProgress = 2
+    LeaseLimit = 1
+    LocalLimit = 1
+    GlobalLimit = 1
+    FaultsEnabled = TRUE
+    FaultServices = {"Coordination", "Durable"}
+    MaxCoordLosses = 1
+    MaxPartitions = 1
+
+INVARIANTS
+    TypeOK
+    StateConsistency
+    AllocatedTokensUsed
+    LiveProgressAligned
+    AtMostOneLiveLeasePerJob
+    AuthorityWellFormed
+    CommittedResultConsistent
+    CancellationSafety
+    PermitSafety
+    ResumeValidity
+    StagingOwnership
+
+PROPERTIES
+    TerminalStateIsImmutable
+    FencingTokensMonotonic
+    CommitIsFencedCAS