Rename mesh-control -> mesh-controller, substrate -> foundation

One name per thing, per the HQ glossary: the module/container/image/binary/repo
becomes mesh-controller, the seat the-controller, and the store+broker pair the
foundation (embedded base bundles, default template and example lock renamed with
their go:embed directives). No behaviour change — a pure vocabulary rename.

Claude-Session: https://claude.ai/code/session_01D6qtiYU3P9jk3pnAXyAFyx

internal/link/enrol_shape_test.go

@@ -11,9 +11,9 @@ import (
 
 	"golang.org/x/crypto/nacl/box"
 
-	"github.com/novox/mesh-control/internal/catalogue"
-	"github.com/novox/mesh-control/internal/inventory"
-	"github.com/novox/mesh-control/internal/link"
+	"github.com/novox/mesh-controller/internal/catalogue"
+	"github.com/novox/mesh-controller/internal/inventory"
+	"github.com/novox/mesh-controller/internal/link"
 )
 
 // What a node says when it joins, as that node's own code writes it.
@@ -25,7 +25,7 @@ import (
 // Skipped unless MESH_ENROL names the file the host's suite wrote:
 //
 //	mesh-host:    MESH_ENROL_OUT=/tmp/enrol.json go test ./internal/link/
-//	mesh-control: MESH_ENROL=/tmp/enrol.json make check
+//	mesh-controller: MESH_ENROL=/tmp/enrol.json make check
 //
 // **What this does not cover**, said so nobody reads more into a pass than is there: the full
 // enrolment path also issues a broker account, and that needs a broker. What is checked here is

internal/link/enrolment.go

@@ -9,9 +9,9 @@ import (
 	"fmt"
 	"sort"
 
-	"github.com/novox/mesh-control/internal/broker"
-	"github.com/novox/mesh-control/internal/identity"
-	"github.com/novox/mesh-control/internal/inventory"
+	"github.com/novox/mesh-controller/internal/broker"
+	"github.com/novox/mesh-controller/internal/identity"
+	"github.com/novox/mesh-controller/internal/inventory"
 )
 
 // Enrolment is what actually happens when a node presents a token: the token is spent, the key is

internal/link/heard_test.go

@@ -5,8 +5,8 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/novox/mesh-control/internal/inventory"
-	"github.com/novox/mesh-control/internal/link"
+	"github.com/novox/mesh-controller/internal/inventory"
+	"github.com/novox/mesh-controller/internal/link"
 )
 
 // Turning what a node said into what the mesh keeps.
@@ -152,7 +152,7 @@ func TestABareAliveDoesNotWipeTheDeclarationThatSaysANodeIsCurrent(t *testing.T)
 func TestAFailureDoesNotBecomeTheAccountOfWhatTheMachineHolds(t *testing.T) {
 	// A partial list is not an account of what the machine holds. Recording one as though it
 	// were would tell a rebuilding node to remove what it still has — which is the fault that
-	// destroyed a substrate once (novox/hq 04-ISSUES/010).
+	// destroyed a foundation once (novox/hq 04-ISSUES/010).
 	inv := inventory.ForTest(t)
 	ctx := context.Background()
 	node, err := inv.AddNode(ctx, "workstation")

internal/link/protocol.go

@@ -88,7 +88,7 @@ type Report struct {
 
 	// Carried are the machine's ports held by what that host raised from its own bundle.
 	//
-	// **The half the mesh cannot know** (novox/hq ADR 0038). The substrate is not a module — a
+	// **The half the mesh cannot know** (novox/hq ADR 0038). The foundation is not a module — a
 	// node raises it before any mesh exists — so without being told, the mesh assigns a module a
 	// port the store or the broker already holds, and hears about it from a container runtime.
 	//