Provably Correct Automatic Subdifferentiation for Qualified Programs