Rename mesh-control -> mesh-controller, substrate -> foundation

One name per thing, per the HQ glossary: the module/container/image/binary/repo
becomes mesh-controller, the seat the-controller, and the store+broker pair the
foundation (embedded base bundles, default template and example lock renamed with
their go:embed directives). No behaviour change — a pure vocabulary rename.

Claude-Session: https://claude.ai/code/session_01D6qtiYU3P9jk3pnAXyAFyx

README.md

@@ -6,7 +6,7 @@ per module under [`modules/`](modules/).
 This is **data, not a control-plane concern**. The manifests describe *what a module is*: what it
 provides, what it requires, the seats it claims, the resources the host applies for it. The
 engine that reads them — parsing, eligibility resolution, sealing, declaration emission — lives
-in the control plane (`novox/mesh-control`, `internal/catalogue`), which consumes this repository
+in the control plane (`novox/mesh-controller`, `internal/catalogue`), which consumes this repository
 as a build source. The host (`novox/mesh-host`) applies the declarations the control plane emits.
 Neither is here.
 
@@ -17,9 +17,9 @@ manifest names its image (pinned by digest), the resources the host owns for it
 files, the container, the private network it joins), what it `requires` from a provider and what
 it `provides` to consumers, and the sealed secrets it needs filled on the machine.
 
-- **Core mesh components are not modules.** The node host, the substrate, the control-plane
+- **Core mesh components are not modules.** The node host, the foundation, the control-plane
   contexts and the surfaces are the mesh itself; they ship as their own repositories
-  (`mesh-host`, `mesh-substrate`, `mesh-control`, `mesh-surfaces`, `mesh-sdk`), not from here.
+  (`mesh-host`, `mesh-foundation`, `mesh-controller`, `mesh-surfaces`, `mesh-sdk`), not from here.
 - **Standalone applications are not here either.** A larger application lives in its own
   repository with its manifest at the root, registered with the mesh as a build source
   (novox/hq [ADR 0010](https://git.novox.be/novox/hq)). This repository holds the modules the
@@ -46,7 +46,7 @@ provider/consumer edge — is data inside the manifests, not a directory the tre
 The shape a manifest must satisfy is owned by the control plane's catalogue engine and is what
 validates a manifest before a machine ever sees it — a stray key, a consumer contributing the
 wrong provision field, an image that nothing builds. That validation belongs with this
-repository and is being re-homed here from `mesh-control`; until it is, the pipeline is the
+repository and is being re-homed here from `mesh-controller`; until it is, the pipeline is the
 gate — it builds each module and refuses a manifest it cannot resolve.
 
 ## Where the reasoning lives