Lean adds verified proof checkers and sandboxed rechecking

Lean v4.35.0 adds a command that rechecks mathematical proofs inside a sandbox, and Lean now ships four additional proof-checking kernels, according to the project's announcement. The command's paranoid mode runs all four plus an official kernel variant that turns memory corruption into a checked abort. One new kernel, con-leche, has a formal consistency proof: environments it accepts have a model in set theory. A Rust translation, con-ron, has been verified to follow its checking algorithm, providing another route to catch compiler or runtime faults. The consistency proof assumes the underlying set theory is consistent. The current external-checking approach also cannot scale to the largest developments described by the project.