Rec.v: simplify proof of [to_of_id].
Rec.v: simplify proof of [to_of_id].

Unfortunately, the other direction, [of_to_id], seems false without
additional constraints: a list passed to [@to_word (ArrayF t n)] is
not necessarily of length [n].  And we need this other direction to
prove Inode.v's [rep_valu_idem].

Possible solutions:
- Have [data (ArrayF t n)] be { l: list (data t) | length l = n }.
- Have [to_word] return an error flag on length mismatch.
- Introduce a predicate for the data structure (e.g., a list) being
  well-formed according to some [Rec.type], which basically boils
  down to the length matching.  Then Inode.v's [rep_valu_idem]
  theorem would require that the block [b] is well-formed.

The last seems the most pleasant to deal with for callers of Rec.v.

mit-pdos/fscq-impl,mit-pdos/fscq-impl,mit-pdos/fscq-impl,mit-pdos/fscq-impl,mit-pdos/fscq-impl