Long division verified via Hoare logic