Correctness of sort in the library (F* seems smarter than we thought...)