Rename mesh-control -> mesh-controller, substrate -> foundation

One name per thing, per the HQ glossary: the module/container/image/binary/repo
becomes mesh-controller, the seat the-controller, and the store+broker pair the
foundation (embedded base bundles, default template and example lock renamed with
their go:embed directives). No behaviour change — a pure vocabulary rename.

Claude-Session: https://claude.ai/code/session_01D6qtiYU3P9jk3pnAXyAFyx

internal/bootstrap/apply_test.go

@@ -78,12 +78,12 @@ func TestASystemNobodyHasBuiltIsRefusedByName(t *testing.T) {
 	}
 }
 
-// A substrate is applied before any mesh exists, so it can carry no secret the mesh sealed — there
+// A foundation is applied before any mesh exists, so it can carry no secret the mesh sealed — there
 // is no key to open one with. Refused with a sentence rather than a nil dereference.
-func TestASealedFileInASubstrateIsRefusedWithAReason(t *testing.T) {
+func TestASealedFileInAFoundationIsRefusedWithAReason(t *testing.T) {
 	_, err := refuseSealed("anything")
 	if err == nil {
-		t.Fatal("a sealed file in a substrate bundle was accepted")
+		t.Fatal("a sealed file in a foundation bundle was accepted")
 	}
 	if !strings.Contains(err.Error(), "has not enrolled") {
 		t.Errorf("the refusal does not say why there is no key: %v", err)