Add Vortex DSE specifications

[vasilisnasopoulos]

Adds specifications/VortexDSE/ — a deterministic slot-based admission
protocol with a separate per-slot agreement layer. A message carries its own
slot stamp and each node decides admission locally against its own clock;
there is no leader, quorum or vote.

Two admission modes, both specified because both are implemented.
Vortex_DSE_CSlot admits a late message into its own slot, so nothing is
dropped. Vortex_DSE_CSlot_TTL rejects it permanently, which bounds memory
behind the frontier. The difference is <= versus = in one conjunct.

Vortex_DSE_CSlot_AE (Freeze / Reconcile / Commit) is specified over the TTL
mode, not the default. Its NoReorderAcrossCslot invariant encodes the strict
gate, so it is not a refinement of the late-tolerant rule; extending it would
mean restating what "no reordering across slots" means, and I have not done
that here. The spec README says this rather than leaving it to be discovered.

Checked:

TLC models	6, all success, 0.6–3.3s
Vortex_DSE_CSlot_Proofs	194 obligations
Vortex_DSE_CSlot_ExactlyOnce_Proof	131 obligations
Vortex_DSE_CSlot_AE_Proofs	34 obligations

All three proof modules exit 0 under tlapm --strict and contain no OMITTED
steps. Model runtimes and state counts in manifest.json were measured with
check_small_models.py locally; check_manifest_schema, check_manifest_files,
check_manifest_features and check_markdown_table all pass.

Scope is deliberately limited: Vortex_DSE_CSlot_Skew states the bounded-skew
assumption structurally but does not model the mechanism that maintains it, and
Reconcile is a single atomic step rather than the multi-round protocol
underneath.

Two notes from preparing this, neither blocking:

• generate_manifest.py rewrites every spec's manifest.json, not only the new
  one; it produced diffs in 14 unrelated manifests, which I reverted. Only
  specifications/VortexDSE/ and the README table are touched here.
• check_proofs.py reads module['proof']['runtime'], but the schema requires
  maxRuntimeMinutes and sets additionalProperties: false. It raises
  KeyError: 'runtime' on any spec with a proof, including on a clean master.
  CI is unaffected because it invokes tlapm directly. Happy to open a separate
  issue or PR for it if useful.

[lemmy]

Isn’t it better if Apalache reports the name of the invariant that’s been violated?