I had to perform some renaming to avoid name clashes.

Annoyingly, this requires one to prove the following in the model:

  (∀ x : A, ■ φ x) ⊢ ■ (∀ x : A, φ x)

Thanks to Ranald Clouston for suggesting the axiom:

  ▷ P ⊢ ▷ False ∨ (▷ False → P)

This axiom is used to prove timeless of implication, wand and forall.

Timelessness of the pure and ownM connectives is still proven in the model, but
we first state the property in a way that it does not involved derived notions
(like the except_last modality).

It is unused, and ownM_empty is stronger.

For that we need a slightly stronger property for distributing a later
over an existential quantifier.

This way we ensure that Coq gives an error message when one accidentially
writes "N ⊆ E" instead of "nclose N ⊆ E". Before, it used the ⊆ instance of
lists.

This happened for example in <[i:=x]>∅, where simpl unfold insert (despite
it being declared simpl never) because ∅ reduces to a constructor.

This avoids Coq distinguishing iProp and uPred (iResUR _) when it
should not.

(which are useful in Amin's logical relations development).

This also removes the double use of the name 'wp_fork' in both
program_logic/weakestpre and heap_lang/lifting.

Add lock interface

@jung looks good?

See merge request !3

NB: these scopes delimiters were already there before Janno's a0067662.