Formal Verification of Zero-Downtime Database Migration in PlusCal