Fix bitcask_pulse model to know when a keydir may have been frozen.

[slfritchie]

Fixes #180.

• Rename bitcask_nifs:keydir_remove/3 -> * bitcask_nifs:keydir_remove_int/3
• Use a compile-time -ifdef magic to add pulse_log_call() wrappers
  around all keydir NIF calls that can mutate the keydir.
• Make several changes to the bitcask_pulse model:
  • Filter out bad reads from either kind of bad folds
  • If a bad read happens, that's bad
  • If a bad fold happens, then figure out during what period of
    at-last-one-folder-is-running-time that the bad result appeared.
    Then figure out if a keydir mutating NIF was called; if yes,
    then it's possible that the keydir was frozen ... we don't know
    for sure, but we won't cause the model to fail in this case.

[slfritchie]

cc: @engelsanchez @jonmeredith

[slfritchie]

ping?

[slfritchie]

ping?

[slfritchie]

@engelsanchez Whatchathink about this model change?

[engelsanchez]

Honestly @slfritchie, I'd like to do this in a different way. I think it should be possible to change our internal API to expose the epochs generated inside of Bitcask that determine the visibility of the values for the folds, as well as the epochs used when folding to verify. That way we can determine exactly what we should be seeing and have a stricter model. I will try to give that a go in the 2.0.2 cycle.