Adopt the glossary's vocabulary in the mutable design docs

"control plane" -> controller and "substrate" -> foundation throughout
03-DESIGN, 00-META and the README, with 06-the-control-plane.md and
07-the-substrate.md renamed to 06-the-controller.md and 07-the-foundation.md.
The immutable 02-DECISIONS records keep their original wording (and links to
them are unchanged) — a term retired here may still appear there, which the
glossary explains how to read.

Claude-Session: https://claude.ai/code/session_01D6qtiYU3P9jk3pnAXyAFyx

03-DESIGN/01-to-be/16-module-coverage.md

@@ -163,14 +163,14 @@ same module. There is one derivation here, and there should stay one.
 sealing is worth its inconvenience.
 
 **An image store is a module, and was written up here as something the mesh does.** It was
-considered for the substrate and removed, because the test is not *can it grant itself one* —
-nearly anything passes that — but whether the control plane needs it before it can give its first
+considered for the foundation and removed, because the test is not *can it grant itself one* —
+nearly anything passes that — but whether the controller needs it before it can give its first
 instruction. It does not. So a registry somebody runs for their own images is the same module as
 the one the mesh runs for its own: it offers a place to push, and claims that role once per
 machine.
 
 **A rule was enforced only at the far end.** A module may not declare an action, and the host
-refused one correctly — but the control plane accepted it into the catalogue, resolved it and
+refused one correctly — but the controller accepted it into the catalogue, resolved it and
 pushed it, so the refusal arrived on a machine with nothing tying it back to the manifest. The
 rule held; it was just unusable, which is the same shape as the network shape that cost five
 failing tests before anyone read the host's log. It is now refused where it is written.