Fix PULSE shrinking control

From Ulf Norell:

    One reason you might have some problem with shrinking (but which should be
    unrelated to the issue at hand) is this code:

      P = ?FORALL(...),
      ?SHRINK(P, [?ALWAYS(3, P)]).

    When you wrap ?ALWAYS on the outside you'll get a fresh command sequence
    for each repetition, so what will (most likely) happen in this case is that
    the shrinking step from P to ?ALWAYS(3, P) fails and shrinking proceeds
    just with P. The right way to do this is to use the shrinking parameter:

      ?FORALL(Cmds, commands(?MODULE),
      ?LET(Shrinking, parameter(shrinking, false),
      ?ALWAYS(if Shrinking -> 3; true -> 1 end,
      ?FORALL(Seed, pulse:seed(),
        ...
      )))).

    Note how the ?ALWAYS is placed between the command generator and the seed
    generator. That way each repetition will use the same command sequence but
    a different seed.