Rename mesh-control -> mesh-controller, substrate -> foundation

One name per thing, per the HQ glossary: the module/container/image/binary/repo
becomes mesh-controller, the seat the-controller, and the store+broker pair the
foundation (embedded base bundles, default template and example lock renamed with
their go:embed directives). No behaviour change — a pure vocabulary rename.

Claude-Session: https://claude.ai/code/session_01D6qtiYU3P9jk3pnAXyAFyx

internal/bundle/bundle.go

@@ -27,13 +27,13 @@ import (
 // nothing and reporting success — a host that silently did nothing on a first node would look
 // exactly like one that worked.
 //
-//go:embed substrate-arch.lock
+//go:embed foundation-arch.lock
 var archLock []byte
 
-//go:embed substrate-alpine.lock
+//go:embed foundation-alpine.lock
 var alpineLock []byte
 
-//go:embed substrate-android.lock
+//go:embed foundation-android.lock
 var androidLock []byte
 
 var locks = map[string][]byte{
@@ -52,7 +52,7 @@ func Raw(system string) []byte { return locks[system] }
 
 // IsEmpty reports whether anything was built in. A bundle of only comments and whitespace is
 // empty for this purpose: a placeholder is a comment, and treating it as content would mean a
-// host claims to carry a substrate it does not.
+// host claims to carry a foundation it does not.
 func IsEmpty(system string) bool {
 	for _, line := range strings.Split(string(locks[system]), "\n") {
 		line = strings.TrimSpace(line)

internal/bundle/bundle_test.go

@@ -13,7 +13,7 @@ func TestADefaultBuildCarriesNothingAndSaysSo(t *testing.T) {
 	// success would look exactly like a host that raised a first node — and the difference
 	// would surface as a mesh that never came up, with nothing to point at.
 	if !IsEmpty("arch") {
-		t.Fatal("the default build claims to carry a substrate")
+		t.Fatal("the default build claims to carry a foundation")
 	}
 	_, err := Load("arch")
 	if !errors.Is(err, ErrEmpty) {

internal/bundle/foundation-alpine.lock

@@ -1,4 +1,4 @@
-// substrate-alpine.lock — the pinned tier-1 descriptor the ALPINE host carries.
+// foundation-alpine.lock — the pinned tier-1 descriptor the ALPINE host carries.
 //
 // Per system, because its CONTENTS are: this one names apk packages and OpenRC services where
 // the arch bundle names pacman packages and systemd units (novox/hq ADR 0005).

internal/bundle/foundation-android.lock

@@ -1,10 +1,10 @@
-// substrate-android.lock — deliberately not a bundle.
+// foundation-android.lock — deliberately not a bundle.
 //
 // An android host cannot raise a mesh, and this file says so rather than being an empty
 // placeholder waiting to be filled in.
 //
-// The substrate is a container runtime, a store and the control plane (novox/hq
-// 07-the-substrate.md). An android host implements `file`, `directory` and `action` and refuses
+// The foundation is a container runtime, a store and the control plane (novox/hq
+// 07-the-foundation.md). An android host implements `file`, `directory` and `action` and refuses
 // `package`, `container` and `service` (ADR 0005) — so every step of the bootstrap is a shape it
 // does not have. No amount of filling this in changes that.
 //

internal/bundle/foundation-arch.lock

@@ -1,4 +1,4 @@
-// substrate-arch.lock — the pinned tier-1 descriptor the ARCH host carries.
+// foundation-arch.lock — the pinned tier-1 descriptor the ARCH host carries.
 //
 // Per system, because its CONTENTS are: package names, unit names and service names all differ
 // (novox/hq ADR 0005). The mechanism is shared; what it names is not.