correct verification of recursive equal implementation
rename equal_and_mismatch.c to equal_recursive.c
fix potential arithmetic overflow by adding more assumptions to "requires"
small lemma proof test
rewrite equal verification to avoid an additional lemma