A mechanical soundness proof for subtyping over recursive types