Rename mesh-control -> mesh-controller, substrate -> foundation

One name per thing, per the HQ glossary: the module/container/image/binary/repo
becomes mesh-controller, the seat the-controller, and the store+broker pair the
foundation (embedded base bundles, default template and example lock renamed with
their go:embed directives). No behaviour change — a pure vocabulary rename.

Claude-Session: https://claude.ai/code/session_01D6qtiYU3P9jk3pnAXyAFyx

internal/bootstrap/registry.go

@@ -44,7 +44,7 @@ type Registry struct {
 //
 // **No credentials, and that is deliberate.** The registry is reached over the mesh's own private
 // network, which is already the encrypted and authenticated thing; a second layer inside it would
-// be certificates to issue and rotate for no property the first does not have (mesh-control's
+// be certificates to issue and rotate for no property the first does not have (mesh-controller's
 // `internal/builder`, which pushes to it the same way). So there is nothing here to configure and
 // nothing to seal — which is also why step 8 can push without the mesh having issued anything.
 //
@@ -136,7 +136,7 @@ func waitForTheRegistry(ctx context.Context, d Deps, o Options, say func(string)
 
 // waitForContainer waits for a container the mesh was asked to create to be running.
 //
-// Unlike the substrate's own verify, this one waits: the mesh applies through a node's host, over
+// Unlike the foundation's own verify, this one waits: the mesh applies through a node's host, over
 // the broker, asynchronously. A push that the control plane accepted has not yet happened on the
 // machine, and refusing on the first look would refuse every correct install.
 func waitForContainer(ctx context.Context, run Runner, probe, wait time.Duration, name string,