Adopt the glossary's vocabulary in the mutable design docs

"control plane" -> controller and "substrate" -> foundation throughout
03-DESIGN, 00-META and the README, with 06-the-control-plane.md and
07-the-substrate.md renamed to 06-the-controller.md and 07-the-foundation.md.
The immutable 02-DECISIONS records keep their original wording (and links to
them are unchanged) — a term retired here may still appear there, which the
glossary explains how to read.

Claude-Session: https://claude.ai/code/session_01D6qtiYU3P9jk3pnAXyAFyx

03-DESIGN/01-to-be/00-work-breakdown.md

@@ -92,7 +92,7 @@ What needs something *usable* retries, which is what both provisioners do and is
 anyway, because a dependency can restart long after everything was applied.
 
 **The network was a real gap, and the first thing in Phase 1 that needed a decision.** Adding a
-shape widens what a compromised control plane can express, so
+shape widens what a compromised controller can express, so
 [ADR 0029](../../02-DECISIONS/0029-a-network-is-a-shape-because-an-action-cannot-be-undone.md)
 records why this one is worth it: an `action` could create a network and **nothing could ever
 remove it**, because an action leaves no footprint the host can undo. The vocabulary is nine.
@@ -106,7 +106,7 @@ not after.
 
 *Done 2026-08-31. Worth recording because the task was not the one written down.*
 
-**The control plane special-cases nothing.** `provides`, `requires`, `contributes` and `grants`
+**The controller special-cases nothing.** `provides`, `requires`, `contributes` and `grants`
 are name-agnostic — asking for a bucket needed no change to the mesh at all. What was missing was
 a provider, and the last step where something on the machine turns a delivered secret into a key
 that works. So "add an object-store provision" was never mesh work.
@@ -200,7 +200,7 @@ losing something.
 
 *2026-08-31.* **The old system's brain is switched off; its services keep running.**
 
-Not a migration and not a period of dual control. The old control plane — provisioning, the
+Not a migration and not a period of dual control. The old controller — provisioning, the
 coordinator, the pipeline, the things that *decide* and *write* — is stopped. Every workload it
 was managing goes on running exactly as it is, because nothing is managing it. Then the new mesh
 takes ownership of them one at a time.
@@ -217,7 +217,7 @@ stop having opinions.
 
 **Disabled, not merely stopped**, and this is the part that is easy to get wrong: those units are
 enabled, so stopping them lasts until the machine reboots. A reboot mid-conversion would bring the
-old control plane back and it would resume regenerating managed files underneath the new one —
+old controller back and it would resume regenerating managed files underneath the new one —
 which is the one situation where two systems really would be fighting over the same machine.
 
 **A service left running with nothing managing it is the safe state.** It has its data, its