Adopt the glossary's vocabulary in the mutable design docs

"control plane" -> controller and "substrate" -> foundation throughout
03-DESIGN, 00-META and the README, with 06-the-control-plane.md and
07-the-substrate.md renamed to 06-the-controller.md and 07-the-foundation.md.
The immutable 02-DECISIONS records keep their original wording (and links to
them are unchanged) — a term retired here may still appear there, which the
glossary explains how to read.

Claude-Session: https://claude.ai/code/session_01D6qtiYU3P9jk3pnAXyAFyx

03-DESIGN/01-to-be/10-delivery.md

@@ -78,7 +78,7 @@ whenever anybody writes something reusable, which is constantly.
 
 ## Delivery is a comparison, not a pipeline
 
-The control plane holds two facts and builds the difference:
+The controller holds two facts and builds the difference:
 
 ```
 what source exists          ─┐
@@ -94,7 +94,7 @@ That is the same shape the host uses on a machine, one layer up:
 
 | | reconciles | against |
 |---|---|---|
-| the control plane | artifacts | source |
+| the controller | artifacts | source |
 | the host | machine state | declarations |
 
 **There is no pipeline as a state machine.** No stage list something can be omitted from, and no
@@ -178,9 +178,9 @@ Not aspirations — things without which the above does not work:
   same digest, a cascade would stop at the first module whose output did not move. Without them,
   one core-library commit redeploys the fleet with no behavioural change.
 - **How a module publishes its own types**, which differs per language.
-- **How the control plane upgrades itself.** It declares its own new version and the host applies
+- **How the controller upgrades itself.** It declares its own new version and the host applies
   it — but if the new one is broken, the thing that would fix it is the thing that is broken. The
-  host has a launcher for exactly this; the control plane has nothing.
+  host has a launcher for exactly this; the controller has nothing.
 
 ## What "behind" means, and what it used to mean