Started on a whole-program type soundness theorem

This should be trivial, since we have type soundness for an individual
top, and the whole program is just a list of tops. But it turns out to
be tricky...