Rename mesh-control -> mesh-controller, substrate -> foundation

One name per thing, per the HQ glossary: the module/container/image/binary/repo
becomes mesh-controller, the seat the-controller, and the store+broker pair the
foundation (embedded base bundles, default template and example lock renamed with
their go:embed directives). No behaviour change — a pure vocabulary rename.

Claude-Session: https://claude.ai/code/session_01D6qtiYU3P9jk3pnAXyAFyx

internal/image/builder.tar

@@ -2,7 +2,7 @@ This is not a saved image. It is the placeholder that keeps this repository buil
 
 A release build replaces this file with the output of `docker save` and puts it back afterwards:
 
-    make bootstrap IMAGE=mesh-control:<version>
+    make bootstrap IMAGE=mesh-controller:<version>
 
 An installer built with this file present carries no control plane, and says so in preflight
 rather than getting a machine part-way to being a mesh and stopping.

internal/image/image.go

@@ -58,7 +58,7 @@ var saved []byte
 var ErrEmpty = errors.New(
 	"this mesh-bootstrap carries no builder image, so it cannot raise a mesh. A release build " +
 		"embeds one: `make bootstrap IMAGE=<image>` in the mesh-host repository, where <image> " +
-		"is a mesh-builder image already built from the mesh-control source")
+		"is a mesh-builder image already built from the mesh-controller source")
 
 // IsEmpty reports whether anything was built in.
 //

internal/image/image_test.go

@@ -72,11 +72,11 @@ func TestTheArchivesOwnIdIsReadFromTheSavedFile(t *testing.T) {
 // does not.
 func TestTheSavedTagsAreRead(t *testing.T) {
 	saved := savedImage(t, map[string]string{
-		"manifest.json": manifest(t, strings.Repeat("b", 64)+".json", "mesh-control:v1"),
+		"manifest.json": manifest(t, strings.Repeat("b", 64)+".json", "mesh-controller:v1"),
 	})
 	got := Tags(saved)
-	if len(got) != 1 || got[0] != "mesh-control:v1" {
-		t.Errorf("tags = %v, want [mesh-control:v1]", got)
+	if len(got) != 1 || got[0] != "mesh-controller:v1" {
+		t.Errorf("tags = %v, want [mesh-controller:v1]", got)
 	}
 }