feat(lean4): add formal verification specs for ensemble models

Lean 4 formalization of the decision tree + MLP ensemble architecture.
Axiomatizes Float properties (sigmoid bounds, ReLU nonnegativity) since
Lean's Float ops are extern-backed. Proves MLP output is bounded in (0,1)
and ensemble output is always a valid decision. No mathlib dependency.

Signed-off-by: Sienna Meridian Satterwhite <sienna@sunbeam.pt>

lean4/Sunbeam/Model/ReLU.lean

@@ -0,0 +1,21 @@
+import Sunbeam.Model.Basic
+
+namespace Sunbeam
+
+/-- ReLU activation: max(0, x). -/
+def relu (x : Float) : Float :=
+  if x > 0.0 then x else 0.0
+
+/-- Pointwise ReLU on a vector. -/
+def reluVec {n : Nat} (v : FloatVec n) : FloatVec n :=
+  fun i => relu (v i)
+
+/-! ## Trust boundary: ReLU axioms -/
+
+/-- ReLU output is non-negative. -/
+axiom relu_nonneg (x : Float) : relu x ≥ 0.0
+
+/-- ReLU is monotone. -/
+axiom relu_monotone {x y : Float} (h : x ≤ y) : relu x ≤ relu y
+
+end Sunbeam