lean-miri: Formally Proving Rust Programs Free of Undefined Behavior