Rename mesh-control -> mesh-controller, substrate -> foundation

One name per thing, per the HQ glossary: the module/container/image/binary/repo
becomes mesh-controller, the seat the-controller, and the store+broker pair the
foundation (embedded base bundles, default template and example lock renamed with
their go:embed directives). No behaviour change — a pure vocabulary rename.

Claude-Session: https://claude.ai/code/session_01D6qtiYU3P9jk3pnAXyAFyx

internal/broker/agreement_test.go

@@ -4,8 +4,8 @@ import (
 	"regexp"
 	"testing"
 
-	"github.com/novox/mesh-control/internal/broker"
-	"github.com/novox/mesh-control/internal/link"
+	"github.com/novox/mesh-controller/internal/broker"
+	"github.com/novox/mesh-controller/internal/link"
 )
 
 // The names are written twice, so a test keeps them agreeing.

internal/broker/management.go

@@ -68,7 +68,7 @@ const ExchangeName = "mesh"
 const BuildQueueName = "builds"
 
 // The events bus (novox/hq ADR 0042): one topic exchange every event rides, a second for tool
-// RPC kept apart, and a dead-letter home for a poison event. The substrate owns these — a module's
+// RPC kept apart, and a dead-letter home for a poison event. The foundation owns these — a module's
 // account cannot declare them, only bind its own queue to the events one.
 const (
 	EventsExchangeName = "mesh.events"
@@ -151,7 +151,7 @@ func (m *Management) CreateModuleAccount(ctx context.Context, node, module, pass
 }
 
 // EnsureModuleQueue declares a consuming module's queue with its dead-letter exchange, idempotently.
-// The substrate declares it because a scoped module account may not: the broker refuses a queue with
+// The foundation declares it because a scoped module account may not: the broker refuses a queue with
 // a dead-letter exchange to a non-administrator (novox/hq ADR 0043), so a consumer passively checks
 // the queue the mesh made rather than declaring its own.
 func (m *Management) EnsureModuleQueue(ctx context.Context, node, module string) error {
@@ -166,7 +166,7 @@ func (m *Management) EnsureModuleQueue(ctx context.Context, node, module string)
 }
 
 // EnsureEventExchanges declares the bus's exchanges and the dead-letter home, idempotently. The
-// substrate owns them (a module's account may not declare an exchange), and a dead-letter exchange
+// foundation owns them (a module's account may not declare an exchange), and a dead-letter exchange
 // with no queue behind it drops what it receives — so a durable queue bound to `#` retains a poison
 // event for inspection, which is the whole reason the trail exists.
 func (m *Management) EnsureEventExchanges(ctx context.Context) error {

internal/broker/module_account_test.go

@@ -9,7 +9,7 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/novox/mesh-control/internal/broker"
+	"github.com/novox/mesh-controller/internal/broker"
 )
 
 // The audit logger consumes everything and emits nothing. Its account must let it declare and read