Rename mesh-control -> mesh-controller, substrate -> foundation

One name per thing, per the HQ glossary: the module/container/image/binary/repo
becomes mesh-controller, the seat the-controller, and the store+broker pair the
foundation (embedded base bundles, default template and example lock renamed with
their go:embed directives). No behaviour change — a pure vocabulary rename.

Claude-Session: https://claude.ai/code/session_01D6qtiYU3P9jk3pnAXyAFyx

Makefile

@@ -36,24 +36,24 @@ test:
 	go test ./... -count=1
 
 # A default build carries no bundle and refuses to reconcile, which is the honest state for a
-# host nobody has told what a substrate is.
+# host nobody has told what a foundation is.
 build:
 	CGO_ENABLED=0 go build -ldflags="$(LDFLAGS)" -o mesh-host ./cmd/mesh-host
 
 # A host for a real machine, carrying a real bundle:
-#   make host SYSTEM=arch BUNDLE=path/to/substrate.lock
+#   make host SYSTEM=arch BUNDLE=path/to/foundation.lock
 #
 # The bundle replaces the one for SYSTEM, because its contents are per operating system —
 # package names and unit names differ (novox/hq ADR 0005).
 host:
 	@test -n "$(BUNDLE)" || { echo "BUNDLE= is required; a host with no bundle cannot raise a first node"; exit 1; }
 	@test -f "$(BUNDLE)" || { echo "no such bundle: $(BUNDLE)"; exit 1; }
-	@test -f internal/bundle/substrate-$(SYSTEM).lock || { echo "no bundle slot for SYSTEM=$(SYSTEM)"; exit 1; }
-	@cp internal/bundle/substrate-$(SYSTEM).lock internal/bundle/substrate-$(SYSTEM).lock.default
-	@cp "$(BUNDLE)" internal/bundle/substrate-$(SYSTEM).lock
+	@test -f internal/bundle/foundation-$(SYSTEM).lock || { echo "no bundle slot for SYSTEM=$(SYSTEM)"; exit 1; }
+	@cp internal/bundle/foundation-$(SYSTEM).lock internal/bundle/foundation-$(SYSTEM).lock.default
+	@cp "$(BUNDLE)" internal/bundle/foundation-$(SYSTEM).lock
 	@CGO_ENABLED=0 go build -ldflags="$(LDFLAGS)" -o mesh-host ./cmd/mesh-host; \
 	  status=$$?; \
-	  mv internal/bundle/substrate-$(SYSTEM).lock.default internal/bundle/substrate-$(SYSTEM).lock; \
+	  mv internal/bundle/foundation-$(SYSTEM).lock.default internal/bundle/foundation-$(SYSTEM).lock; \
 	  exit $$status
 	@echo "built for $(SYSTEM) carrying $(BUNDLE)"
 
@@ -66,7 +66,7 @@ host:
 # answered by ADR 0071: the source comes from a mesh that already exists, which is not the one being
 # raised. What cannot be fetched is the thing that does the fetching, and that is what is carried.
 #
-# The image is BUILT ELSEWHERE and handed over — mesh-control's own `make builder-image` — and
+# The image is BUILT ELSEWHERE and handed over — mesh-controller's own `make builder-image` — and
 # embedded here at release time, the same way carrying the bundle breaks the "copy it onto a machine
 # and run it" cycle (novox/hq ADR 0005).
 #
@@ -90,7 +90,7 @@ BOOTSTRAP_OUT ?= mesh-bootstrap
 bootstrap:
 	@test -n "$(IMAGE)" || { echo "IMAGE= is required; an installer carrying no builder image cannot raise a mesh"; exit 1; }
 	@case "$(IMAGE)" in sha256:*) echo "IMAGE=$(IMAGE) is an image id. The installer identifies the carried image by its tag, because an id is the digest of a configuration that a runtime rewrites as it loads. Pass a name:tag"; exit 1;; esac
-	@docker image inspect "$(IMAGE)" >/dev/null 2>&1 || { echo "this machine does not hold $(IMAGE) — build it in mesh-control with 'make image'"; exit 1; }
+	@docker image inspect "$(IMAGE)" >/dev/null 2>&1 || { echo "this machine does not hold $(IMAGE) — build it in mesh-controller with 'make image'"; exit 1; }
 	@test -n "$$(docker image inspect --format '{{len .RepoTags}}' "$(IMAGE)" | grep -v '^0$$')" || { echo "$(IMAGE) has no repository tag, so the saved archive would carry no name the installer can ask a runtime about. Tag it first: docker tag $(IMAGE) mesh-builder:<version>"; exit 1; }
 	@cp internal/image/builder.tar internal/image/builder.tar.placeholder
 	@docker save --output internal/image/builder.tar "$(IMAGE)"