Model the membership merges using TLA+

Would be nice to model the merge formally, to sanity check we're not missing any edge case.

The merges are generally simple, except for removal which involves some special handling.

Start by tracing the membership merge behavior in the Swift Distributed Actors repository, with particular attention to the special handling for removal described in the issue. Define a TLA+ model covering the general merges and removal case, then use it to check for missing edge cases.

Written by the indexing model from the issue text.