Rename mesh-control -> mesh-controller, substrate -> foundation

One name per thing, per the HQ glossary: the module/container/image/binary/repo
becomes mesh-controller, the seat the-controller, and the store+broker pair the
foundation (embedded base bundles, default template and example lock renamed with
their go:embed directives). No behaviour change — a pure vocabulary rename.

Claude-Session: https://claude.ai/code/session_01D6qtiYU3P9jk3pnAXyAFyx

internal/store/store.go

@@ -35,7 +35,7 @@ type Applied struct {
 	Type string `json:"type"`
 	// Origin is who asked for this: the bundle this host carries, or the mesh.
 	//
-	// Recorded because the two must not remove each other. A node raises its own substrate from
+	// Recorded because the two must not remove each other. A node raises its own foundation from
 	// the bundle before any mesh exists, then enrols and is sent declarations — and a
 	// declaration naming two resources would otherwise remove the store, the broker and the
 	// control plane, which is 04-ISSUES/010 and happened on the first end-to-end run.
@@ -47,7 +47,7 @@ type Applied struct {
 	// Holds are the machine's own ports this resource occupies.
 	//
 	// **So the mesh can assign around what it did not put here** (novox/hq ADR 0038). A node
-	// raises its substrate from the bundle before any mesh exists, so the control plane has never
+	// raises its foundation from the bundle before any mesh exists, so the control plane has never
 	// heard of the store, the broker or the control plane's own container — and a module assigned
 	// afterwards would be given a port one of them already holds, and would be told so by a
 	// container runtime rather than by anything that could have prevented it.
@@ -226,7 +226,7 @@ const (
 //
 // State written before origins existed was all bundle-applied: a host had no other way to be
 // told anything. Guessing wrong in the other direction would have a first upgrade remove the
-// substrate, which is the fault this field exists to prevent.
+// foundation, which is the fault this field exists to prevent.
 func originOf(r Applied) string {
 	if r.Origin == "" {
 		return OriginCarried

internal/store/store_test.go

@@ -136,7 +136,7 @@ func TestNothingIsAnOrphanWhenEverythingIsDeclared(t *testing.T) {
 }
 
 func TestADeclarationDoesNotOrphanWhatTheBundleRaised(t *testing.T) {
-	// 04-ISSUES/010. A first node raises its substrate from the bundle it carries, then enrols
+	// 04-ISSUES/010. A first node raises its foundation from the bundle it carries, then enrols
 	// and is sent a declaration naming two resources. Before origins, that removed the store, the
 	// broker and the control plane that had sent it — the mesh deleting itself over the link the
 	// message arrived on, in under a second, on the first end-to-end run.
@@ -175,7 +175,7 @@ func TestTheBundleDoesNotOrphanWhatTheMeshDeclared(t *testing.T) {
 func TestStateWrittenBeforeOriginsExistedIsTreatedAsCarried(t *testing.T) {
 	// Every resource a host had applied before this field existed came from its bundle, because
 	// there was no other way to tell it anything. Guessing the other way would have the first
-	// declaration remove the substrate — which is the fault this exists to prevent, arriving
+	// declaration remove the foundation — which is the fault this exists to prevent, arriving
 	// through the upgrade that fixes it.
 	s := State{Resources: []Applied{{ID: "store", Type: "container", Target: "mesh-store"}}}