Rename mesh-control -> mesh-controller, substrate -> foundation

One name per thing, per the HQ glossary: the module/container/image/binary/repo
becomes mesh-controller, the seat the-controller, and the store+broker pair the
foundation (embedded base bundles, default template and example lock renamed with
their go:embed directives). No behaviour change — a pure vocabulary rename.

Claude-Session: https://claude.ai/code/session_01D6qtiYU3P9jk3pnAXyAFyx

internal/store/store.go

@@ -35,7 +35,7 @@ type Applied struct {
 	Type string `json:"type"`
 	// Origin is who asked for this: the bundle this host carries, or the mesh.
 	//
-	// Recorded because the two must not remove each other. A node raises its own substrate from
+	// Recorded because the two must not remove each other. A node raises its own foundation from
 	// the bundle before any mesh exists, then enrols and is sent declarations — and a
 	// declaration naming two resources would otherwise remove the store, the broker and the
 	// control plane, which is 04-ISSUES/010 and happened on the first end-to-end run.
@@ -47,7 +47,7 @@ type Applied struct {
 	// Holds are the machine's own ports this resource occupies.
 	//
 	// **So the mesh can assign around what it did not put here** (novox/hq ADR 0038). A node
-	// raises its substrate from the bundle before any mesh exists, so the control plane has never
+	// raises its foundation from the bundle before any mesh exists, so the control plane has never
 	// heard of the store, the broker or the control plane's own container — and a module assigned
 	// afterwards would be given a port one of them already holds, and would be told so by a
 	// container runtime rather than by anything that could have prevented it.
@@ -226,7 +226,7 @@ const (
 //
 // State written before origins existed was all bundle-applied: a host had no other way to be
 // told anything. Guessing wrong in the other direction would have a first upgrade remove the
-// substrate, which is the fault this field exists to prevent.
+// foundation, which is the fault this field exists to prevent.
 func originOf(r Applied) string {
 	if r.Origin == "" {
 		return OriginCarried