Rename mesh-control -> mesh-controller, substrate -> foundation

One name per thing, per the HQ glossary: the module/container/image/binary/repo
becomes mesh-controller, the seat the-controller, and the store+broker pair the
foundation (embedded base bundles, default template and example lock renamed with
their go:embed directives). No behaviour change — a pure vocabulary rename.

Claude-Session: https://claude.ai/code/session_01D6qtiYU3P9jk3pnAXyAFyx

internal/overlay/declaration.go

@@ -127,7 +127,7 @@ func config(node Node, peers []Peer, keyPath string) string {
 		b.WriteString("PostDown = sysctl -q -w net.ipv4.ip_forward=0\n")
 
 		// And past the machine's own firewall, which on any node with a container runtime is
-		// closed. Docker sets the FORWARD policy to DROP and inserts its chains, so the substrate
+		// closed. Docker sets the FORWARD policy to DROP and inserts its chains, so the foundation
 		// this mesh installs at tier 1 silently breaks the network it builds at tier 2: every
 		// spoke reaches the hub, no spoke reaches any other, and every part of it reports
 		// success. Found in the lab; nothing about it is visible from the mesh's own state.

internal/overlay/generator.go

@@ -5,7 +5,7 @@ import (
 	"fmt"
 	"strconv"
 
-	"github.com/novox/mesh-control/internal/catalogue"
+	"github.com/novox/mesh-controller/internal/catalogue"
 )
 
 // The private network as a module rather than as code beside the module system.

internal/overlay/opens_test.go

@@ -4,7 +4,7 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/novox/mesh-control/internal/catalogue"
+	"github.com/novox/mesh-controller/internal/catalogue"
 )
 
 func networkOf(t *testing.T, nodes []Node) *Generator {