Rename mesh-control -> mesh-controller, substrate -> foundation

One name per thing, per the HQ glossary: the module/container/image/binary/repo
becomes mesh-controller, the seat the-controller, and the store+broker pair the
foundation (embedded base bundles, default template and example lock renamed with
their go:embed directives). No behaviour change — a pure vocabulary rename.

Claude-Session: https://claude.ai/code/session_01D6qtiYU3P9jk3pnAXyAFyx

internal/bootstrap/publish.go

@@ -9,19 +9,19 @@ import (
 )
 
 // ControlPlaneRepository is what the control plane's image is called in the mesh's own registry.
-const ControlPlaneRepository = "mesh-control"
+const ControlPlaneRepository = "mesh-controller"
 
 // genesisTag is the tag the first push uses.
 //
 // A tag is not a pin and is never what anything is deployed from — the digest the registry assigns
-// is (novox/hq ADR 0006). This exists so a person reading `/v2/mesh-control/tags/list` can see
+// is (novox/hq ADR 0006). This exists so a person reading `/v2/mesh-controller/tags/list` can see
 // which image this mesh started from, and so the push has something to name. Everything downstream
 // uses the digest that comes back.
 const genesisTag = "genesis"
 
 // Published is what step 8 did.
 type Published struct {
-	// Reference is `<registry>/mesh-control@sha256:…` — the first manifest digest this image has
+	// Reference is `<registry>/mesh-controller@sha256:…` — the first manifest digest this image has
 	// ever had, and the thing that makes the control plane an ordinary module.
 	Reference string
 	// Tagged is where it was pushed, tag and all.
@@ -34,7 +34,7 @@ type Published struct {
 //
 // **This is the pivot's hinge.** Every image must be pinned by digest, and a digest a pin can mean
 // is one a REGISTRY assigned when something was pushed to it. The control plane's image is built
-// from source and pushed nowhere, so it has none — which is why the substrate names it by the
+// from source and pushed nowhere, so it has none — which is why the foundation names it by the
 // digest of its own configuration, and why that is legal exactly where nothing could have served
 // one. The moment this push completes, that stops being true: the image has a manifest digest, so
 // the control plane can be named the way every other module is named, so the mesh can build and
@@ -42,7 +42,7 @@ type Published struct {
 // upgrade itself, which is the check novox/hq ADR 0067 states: after installing, the running
 // control plane must be pinned by a digest the mesh's own registry assigned, not by an image id.
 //
-// **It mirrors mesh-control's `internal/builder`.PublishImage rather than importing it.** Tag,
+// **It mirrors mesh-controller's `internal/builder`.PublishImage rather than importing it.** Tag,
 // push, read back `RepoDigests`, refuse anything without `@sha256:` — the same four steps, because
 // there is exactly one right way to learn what a registry will serve something as, and it is to
 // ask the registry. It is not imported because that code is tier 2: the host and its installer