Rename mesh-control -> mesh-controller, substrate -> foundation

One name per thing, per the HQ glossary: the module/container/image/binary/repo
becomes mesh-controller, the seat the-controller, and the store+broker pair the
foundation (embedded base bundles, default template and example lock renamed with
their go:embed directives). No behaviour change — a pure vocabulary rename.

Claude-Session: https://claude.ai/code/session_01D6qtiYU3P9jk3pnAXyAFyx

modules/anthropic-manager/grantfile.ts

@@ -1,9 +1,9 @@
 // Reading the manager node's PUBLIC sealing key out of the bound facts the mesh delivers, and
-// writing a sealed refresh token in the wire shape mesh-control reads.
+// writing a sealed refresh token in the wire shape mesh-controller reads.
 //
 // **The public key is delivered, not derived.** The manager module holds no node key of its own
 // (novox/hq ADR 0050) — it is deliberately never given one. To seal a refresh token to this node it
-// needs the node's PUBLIC sealing key, and mesh-control puts that in the manager holder's bound facts
+// needs the node's PUBLIC sealing key, and mesh-controller puts that in the manager holder's bound facts
 // (`serves.manager_public_key`), safe to disclose because it is public. Both adoption and every
 // rotation read it from there.
 
@@ -23,7 +23,7 @@ export function managerPublicKey(boundFile: string): string {
   return key;
 }
 
-/** Write a sealed refresh token in the {sealed, manager_key} wire shape mesh-control reads. */
+/** Write a sealed refresh token in the {sealed, manager_key} wire shape mesh-controller reads. */
 export function writeSealedGrant(path: string, sealed: string, managerKey: string): void {
   mkdirSync(dirname(path), { recursive: true });
   const tmp = `${path}.tmp`;