Adopt the glossary's vocabulary in the mutable design docs

"control plane" -> controller and "substrate" -> foundation throughout
03-DESIGN, 00-META and the README, with 06-the-control-plane.md and
07-the-substrate.md renamed to 06-the-controller.md and 07-the-foundation.md.
The immutable 02-DECISIONS records keep their original wording (and links to
them are unchanged) — a term retired here may still appear there, which the
glossary explains how to read.

Claude-Session: https://claude.ai/code/session_01D6qtiYU3P9jk3pnAXyAFyx

03-DESIGN/01-to-be/19-the-module-protocol.md

@@ -58,7 +58,7 @@ mesh can issue anything. An implementation accepts both and must not treat the s
 - The connection **pins the fingerprint**. It does not trust a certificate authority, and it does
   not skip verification. A broker presenting a different certificate is refused, whatever else is
   true of it.
-- A scoped account **does not declare exchanges**. The substrate owns them; an account that may
+- A scoped account **does not declare exchanges**. The foundation owns them; an account that may
   declare one is an account that may create a parallel mesh by typo.
 - An implementation **declares its own queue** and nothing else.
 
@@ -142,7 +142,7 @@ A module's tools are its operator-facing surface.
 ### Not yet true
 
 The caller's half has no account. Until that is settled, the only thing that can ask a module a
-question is the substrate's bootstrap admin, which is not a protocol so much as a way in.
+question is the foundation's bootstrap admin, which is not a protocol so much as a way in.
 
 ---