Rename mesh-control -> mesh-controller, substrate -> foundation

One name per thing, per the HQ glossary: the module/container/image/binary/repo
becomes mesh-controller, the seat the-controller, and the store+broker pair the
foundation (embedded base bundles, default template and example lock renamed with
their go:embed directives). No behaviour change — a pure vocabulary rename.

Claude-Session: https://claude.ai/code/session_01D6qtiYU3P9jk3pnAXyAFyx

modules/anthropic-manager/refresh/index.ts

@@ -12,13 +12,13 @@
 //      never the refresh token — which it seals per consumer holder and stores;
 //   5. poll usage with the fresh access token and record the licence-grain reading.
 //
-// mesh-control receives the products of steps 3–4 through `licence submit-refresh` (access token +
+// mesh-controller receives the products of steps 3–4 through `licence submit-refresh` (access token +
 // sealed box). The refresh token never leaves this process except as ciphertext, and it never had to
 // be opened here at all — the host did that.
 //
 // This runs as `mesh-tools run`, which connects no broker, so the outputs are written to files the
-// host mounts; the submit itself (the transport to mesh-control) is done by the caller invoking
-// `mesh-control licence submit-refresh`. In the lab that caller is the scenario; in production it is
+// host mounts; the submit itself (the transport to mesh-controller) is done by the caller invoking
+// `mesh-controller licence submit-refresh`. In the lab that caller is the scenario; in production it is
 // an authenticated call the manager node makes. The transport is the one part stubbed here — FLAGGED
 // — because a cross-node authenticated command surface is out of this module's scope.