This is a purely accidental dependency; purge it.

With this patch, the model module is finally completely independent of
any definitions or proofs in the analysis module.

This fixes all warnings about ambiguous module names and resolves #49.

It also highlights that we still need to cut down on superfluous
Require Import commands in recently ported files.