BROKEN: restructure much of ModelChecker as ModelExecution class

BROKEN: restructure much of ModelChecker as ModelExecution class

This will *not* compile fully. It is an interim step in which I move
much of the ModelChecker code into a separate class which does not need
to be globally-accessible. The next few commits should fix the compile
problems as I rewrite/remove some interfaces.