model: remove redundant code (is_enabled)

These members should just stay implemented in execution.{cc,h}, not
model.{cc,h}.
execution: document promises list; it is assumed to be sorted

Document the assumptions made about the 'promises' list.
execution: document additional mo_may_allow() optimization

mo_may_allow() actually performs two optimizations, not just the one
that is documented in its header.
execution: remove redundant condition, reword doc for promises_may_allow

promises_may_allow() doesn't actually need to check for
promises.empty(), as the loop bounds take care of that. In the same
spirit, we can reword the comments/documentation so that

 (1) it is not redundant (condition (a) is subsumed by (b))
 (2) we are more explicit about what we actually mean by "crossing
     promises"