AR-Pro: Counterfactual Explanations for Anomaly Repair with Formal Properties