Reproducing the AWS Outage Race Condition with a Model Checker