Fix env_corr2 guarantee promise
Fix env_corr2 guarantee promise

Rather than hypothesizing StepOther m0 m1 -> rely m0 m1 for all m0 m1, it
only required m0 m1 for the specific memories for which StepThis m0 m1
was true, which is unhelpful.

Fixing this definition requires no proof changes in compose and its
lemmas.

Also finishes guarantee part of write_cok.

mit-pdos/fscq-impl,mit-pdos/fscq-impl,mit-pdos/fscq-impl,mit-pdos/fscq-impl,mit-pdos/fscq-impl