Rename mesh-control -> mesh-controller, substrate -> foundation

One name per thing, per the HQ glossary: the module/container/image/binary/repo
becomes mesh-controller, the seat the-controller, and the store+broker pair the
foundation (embedded base bundles, default template and example lock renamed with
their go:embed directives). No behaviour change — a pure vocabulary rename.

Claude-Session: https://claude.ai/code/session_01D6qtiYU3P9jk3pnAXyAFyx

internal/overlay/declaration.go

@@ -127,7 +127,7 @@ func config(node Node, peers []Peer, keyPath string) string {
 		b.WriteString("PostDown = sysctl -q -w net.ipv4.ip_forward=0\n")
 
 		// And past the machine's own firewall, which on any node with a container runtime is
-		// closed. Docker sets the FORWARD policy to DROP and inserts its chains, so the substrate
+		// closed. Docker sets the FORWARD policy to DROP and inserts its chains, so the foundation
 		// this mesh installs at tier 1 silently breaks the network it builds at tier 2: every
 		// spoke reaches the hub, no spoke reaches any other, and every part of it reports
 		// success. Found in the lab; nothing about it is visible from the mesh's own state.