feat(lean4): add formal verification specs for ensemble models

Lean 4 formalization of the decision tree + MLP ensemble architecture.
Axiomatizes Float properties (sigmoid bounds, ReLU nonnegativity) since
Lean's Float ops are extern-backed. Proves MLP output is bounded in (0,1)
and ensemble output is always a valid decision. No mathlib dependency.

Signed-off-by: Sienna Meridian Satterwhite <sienna@sunbeam.pt>

lean4/Sunbeam/Model/MLP.lean

@@ -0,0 +1,30 @@
+import Sunbeam.Model.Basic
+import Sunbeam.Model.Sigmoid
+import Sunbeam.Model.ReLU
+
+namespace Sunbeam
+
+/-- Weights for a 2-layer MLP (input → hidden → scalar output). -/
+structure MLPWeights (inputDim hiddenDim : Nat) where
+  w1 : Fin hiddenDim → FloatVec inputDim
+  b1 : FloatVec hiddenDim
+  w2 : FloatVec hiddenDim
+  b2 : Float
+
+/-- Forward pass: input → linear1 → ReLU → linear2 → sigmoid. -/
+def mlpForward {inputDim hiddenDim : Nat}
+    (weights : MLPWeights inputDim hiddenDim) (input : FloatVec inputDim) : Float :=
+  let hidden := vecAdd (matVecMul weights.w1 input) weights.b1
+  let activated := reluVec hidden
+  let output := dot weights.w2 activated + weights.b2
+  sigmoid output
+
+/-- MLP output is bounded in (0, 1) — follows directly from sigmoid bounds. -/
+theorem mlp_output_bounded {inputDim hiddenDim : Nat}
+    (weights : MLPWeights inputDim hiddenDim) (input : FloatVec inputDim) :
+    0 < mlpForward weights input ∧ mlpForward weights input < 1 := by
+  constructor
+  · exact sigmoid_pos _
+  · exact sigmoid_lt_one _
+
+end Sunbeam