A Fully Verified Executable LTL Model Checker