Rename mesh-control -> mesh-controller, substrate -> foundation

One name per thing, per the HQ glossary: the module/container/image/binary/repo
becomes mesh-controller, the seat the-controller, and the store+broker pair the
foundation (embedded base bundles, default template and example lock renamed with
their go:embed directives). No behaviour change — a pure vocabulary rename.

Claude-Session: https://claude.ai/code/session_01D6qtiYU3P9jk3pnAXyAFyx

cmd/mesh-host/main.go

@@ -823,7 +823,7 @@ func sealOpener(statePath string) apply.Unseal {
 
 // carriedPorts is every machine port held by what this host raised from its own bundle.
 //
-// **What the mesh must assign around** (novox/hq ADR 0038). The substrate is not a module: a node
+// **What the mesh must assign around** (novox/hq ADR 0038). The foundation is not a module: a node
 // raises it before any mesh exists, so the control plane has never heard of the store or the
 // broker. Told this, it can put a module somewhere else; not told, it hands out a port one of them
 // holds and finds out from a container runtime.