Rename mesh-control -> mesh-controller, substrate -> foundation

One name per thing, per the HQ glossary: the module/container/image/binary/repo
becomes mesh-controller, the seat the-controller, and the store+broker pair the
foundation (embedded base bundles, default template and example lock renamed with
their go:embed directives). No behaviour change — a pure vocabulary rename.

Claude-Session: https://claude.ai/code/session_01D6qtiYU3P9jk3pnAXyAFyx

internal/bootstrap/apply.go

@@ -15,7 +15,7 @@ import (
 // Runner is the same runner every applier in this repository takes.
 type Runner = apply.Runner
 
-// ApplyBundle raises the substrate, through the host's own apply.
+// ApplyBundle raises the foundation, through the host's own apply.
 //
 // **This calls `internal/apply` rather than running the `mesh-host` binary**, and that is worth
 // stating because shelling out would have been easier. The installer and the host must apply a
@@ -25,7 +25,7 @@ type Runner = apply.Runner
 // raising, which would make the installer depend on the thing it installs.
 //
 // It applies under `store.OriginCarried`, which is the same origin `mesh-host reconcile` uses and
-// is not a detail: what the substrate raised must be invisible to the removal pass of a
+// is not a detail: what the foundation raised must be invisible to the removal pass of a
 // declaration that later arrives from the control plane, or the first thing the mesh tells this
 // node would tear down the mesh (novox/hq 04-ISSUES/010).
 //
@@ -71,12 +71,12 @@ func ApplyBundle(ctx context.Context, o Options, sys system.System, d *declarati
 //
 // It cannot happen and it is refused with a sentence rather than a nil dereference. A sealing key
 // is generated at enrolment (`internal/identity`), and enrolment is something that happens on a
-// mesh — which is the thing this program is raising. A substrate bundle carrying a sealed file
+// mesh — which is the thing this program is raising. A foundation bundle carrying a sealed file
 // would be a bundle written for a node that has already joined.
 func refuseSealed(string) ([]byte, error) {
 	return nil, errors.New(
 		"this bundle contains a file sealed to a node's key, and a machine that has not enrolled " +
-			"has no such key. A substrate is applied before any mesh exists, so it can carry no " +
+			"has no such key. A foundation is applied before any mesh exists, so it can carry no " +
 			"secret the mesh sealed")
 }