v0.37.0

This release adds #[invariant(always_run)] for stateful tests (#449). A plain #[invariant] is checked in full on the machine's initial and final state and sampled in between; an always-run invariant runs after every rule (at every join point, for concurrent machines) instead. Use it for invariants that must observe every intermediate state, including invariants that mutate state when checked:

#[invariant(always_run)]
fn no_unobserved_writes(&mut self, _: TestCase) {
    assert!(self.writes_since_last_check <= 1);
    self.writes_since_last_check = 0;
}

For hand-written StateMachine implementations this is a breaking change: invariants() now returns Vec<Invariant<Self>> instead of Vec<Rule<Self>> — construct entries with Invariant::new (sampled) or Invariant::new_always_run. ConcurrentInvariant gains the same always_run field and new_always_run constructor.

libhegel C ABI

This release changes hegel_new_state_machine: it takes a new
invariant_always_check argument, an array of per-invariant flags parallel to
invariant_names (NULL for all false).
hegel_state_machine_should_check_invariant answers true unconditionally for
a flagged invariant, consuming no entropy, and samples the rest as before.