Proofs about Patina, the Rust formalization