most of the proof for word_for_ok
most of the proof for word_for_ok

now the for loop is defined using refine instead of Function.

4 remaining [admit]s in [word_for_ok] deal with not
overflowing/underflowing the loop counter.

mit-pdos/fscq-impl,mit-pdos/fscq-impl,mit-pdos/fscq-impl,mit-pdos/fscq-impl,mit-pdos/fscq-impl