Rename mesh-control -> mesh-controller, substrate -> foundation

One name per thing, per the HQ glossary: the module/container/image/binary/repo
becomes mesh-controller, the seat the-controller, and the store+broker pair the
foundation (embedded base bundles, default template and example lock renamed with
their go:embed directives). No behaviour change — a pure vocabulary rename.

Claude-Session: https://claude.ai/code/session_01D6qtiYU3P9jk3pnAXyAFyx

README.md

@@ -111,7 +111,7 @@ the fault this exists to prevent.
 A host built for a machine carries its declaration **inside the binary**:
 
 ```
-make host BUNDLE=path/to/substrate.lock
+make host BUNDLE=path/to/foundation.lock
 ```
 
 `mesh-host reconcile` then applies it. That is the first node's path — no mesh present, nothing
@@ -126,21 +126,21 @@ Stages 3 and 4 — the link, and enrolment — are designed and not built.
 
 ## What stage 2 does not yet prove
 
-The design defines stage 2 as *the host applies `substrate.lock` with no mesh present*, and
-calls out the claim underneath it: **that one host can raise the substrate alone**.
+The design defines stage 2 as *the host applies `foundation.lock` with no mesh present*, and
+calls out the claim underneath it: **that one host can raise the foundation alone**.
 
 The mechanism is proved — a sealed machine, one binary, and it configures itself from what it
-carries. The claim is not. The substrate is four container services, and:
+carries. The claim is not. The foundation is four container services, and:
 
 - the vocabulary has no container type, because a container needs an image and where images
   come from is open ([`novox/hq` research 012](https://git.novox.be/novox/hq));
-- what belongs in a substrate is not known — the closure for a one-node mesh is what
+- what belongs in a foundation is not known — the closure for a one-node mesh is what
   research 011 and 012 exist to answer;
 - and the machine used to test this has no container runtime, because a sealed network cannot
   install one.
 
-So `substrate.lock` here is a real bundle with a placeholder's content. Saying that plainly
-beats shipping a host that claims a substrate it has never raised.
+So `foundation.lock` here is a real bundle with a placeholder's content. Saying that plainly
+beats shipping a host that claims a foundation it has never raised.
 
 ## A capability is detected, never assumed
 
@@ -198,7 +198,7 @@ repository carries implementation and does not carry decisions.
 
 ## Checks that cross into the control plane's repository
 
-Two things are agreed between this repository and `novox/mesh-control`, and each is a separate
+Two things are agreed between this repository and `novox/mesh-controller`, and each is a separate
 struct on each side. A field renamed on one of them fails **silently** — the crossing succeeds and
 something is simply absent — so both are checked by handing one side's real output to the other's
 real parser. Neither runs by default; each skips with a reason, because a repository that fails
@@ -207,7 +207,7 @@ without its neighbour checked out is a repository nobody can build.
 **What the mesh sends, read by this host:**
 
 ```
-mesh-control:  ./build/mesh-control plan <node> --json > /tmp/d.json
+mesh-controller:  ./build/mesh-controller plan <node> --json > /tmp/d.json
 mesh-host:     MESH_EMITTED=/tmp/d.json go test ./internal/declaration/ -v
 ```
 
@@ -215,7 +215,7 @@ mesh-host:     MESH_EMITTED=/tmp/d.json go test ./internal/declaration/ -v
 
 ```
 mesh-host:     MESH_ENROL_OUT=/tmp/enrol.json go test ./internal/link/
-mesh-control:  MESH_ENROL=/tmp/enrol.json make check
+mesh-controller:  MESH_ENROL=/tmp/enrol.json make check
 ```
 
 The second writes the private half of the sealing key beside the request, so the mesh's suite can