feat(lean4): add formal verification specs for ensemble models

Lean 4 formalization of the decision tree + MLP ensemble architecture.
Axiomatizes Float properties (sigmoid bounds, ReLU nonnegativity) since
Lean's Float ops are extern-backed. Proves MLP output is bounded in (0,1)
and ensemble output is always a valid decision. No mathlib dependency.

Signed-off-by: Sienna Meridian Satterwhite <sienna@sunbeam.pt>

lean4/Sunbeam/Model/DecisionTree.lean

@@ -0,0 +1,23 @@
+import Sunbeam.Model.Basic
+
+namespace Sunbeam
+
+/-- A decision tree node (inductive = automatic termination for structural recursion). -/
+inductive TreeNode where
+  | leaf (decision : Decision) : TreeNode
+  | split (featureIdx : Nat) (threshold : Float) (left right : TreeNode) : TreeNode
+  deriving Repr
+
+/-- Tree prediction by structural recursion (termination is automatic). -/
+def treePredictAux {n : Nat} (input : Fin n → Float) : TreeNode → Decision
+  | .leaf d => d
+  | .split idx thr left right =>
+    if h : idx < n then
+      if input ⟨idx, h⟩ ≤ thr then
+        treePredictAux input left
+      else
+        treePredictAux input right
+    else
+      Decision.defer
+
+end Sunbeam