Rename mesh-control -> mesh-controller, substrate -> foundation

One name per thing, per the HQ glossary: the module/container/image/binary/repo
becomes mesh-controller, the seat the-controller, and the store+broker pair the
foundation (embedded base bundles, default template and example lock renamed with
their go:embed directives). No behaviour change — a pure vocabulary rename.

Claude-Session: https://claude.ai/code/session_01D6qtiYU3P9jk3pnAXyAFyx

one-node-mesh-report.json

@@ -1,18 +1,18 @@
 {
   "scenario": "one-node-mesh",
-  "established": 21,
+  "established": 22,
   "of": 22,
   "steps": [
     {
       "code": "R1",
       "title": "a bare machine becomes a mesh of one, raised by the installer",
       "status": "pass",
-      "seconds": 122,
+      "seconds": 316,
       "why": ""
     },
     {
       "code": "R2",
-      "title": "the substrate is up — a store and a broker of the mesh's own",
+      "title": "the foundation is up — a store and a broker of the mesh's own",
       "status": "pass",
       "seconds": 1,
       "why": ""
@@ -56,63 +56,63 @@
       "code": "P1",
       "title": "the mesh builds the shared base from source",
       "status": "pass",
-      "seconds": 85,
+      "seconds": 3,
       "why": ""
     },
     {
       "code": "P2",
       "title": "the mesh builds and runs a store of its own",
       "status": "pass",
-      "seconds": 38,
+      "seconds": 7,
       "why": ""
     },
     {
       "code": "P3",
       "title": "the mesh builds and runs its own catalogue",
       "status": "pass",
-      "seconds": 31,
+      "seconds": 4,
       "why": ""
     },
     {
       "code": "P4",
       "title": "the mesh rebuilds its own control plane from source",
       "status": "pass",
-      "seconds": 32,
+      "seconds": 30,
       "why": ""
     },
     {
       "code": "N1",
       "title": "the mesh puts itself on a private network, and its machine has a name",
       "status": "pass",
-      "seconds": 6,
+      "seconds": 4,
       "why": ""
     },
     {
       "code": "N2",
       "title": "the machine has a packet filter, loaded from what modules declared",
       "status": "pass",
-      "seconds": 7,
+      "seconds": 2,
       "why": ""
     },
     {
       "code": "U1",
       "title": "the mesh builds a module standing on that base",
       "status": "pass",
-      "seconds": 13,
+      "seconds": 14,
       "why": ""
     },
     {
       "code": "U2",
       "title": "the mesh runs a broker for that module to talk to",
       "status": "pass",
-      "seconds": 24,
+      "seconds": 26,
       "why": ""
     },
     {
       "code": "U3",
       "title": "the anchor runs the module the mesh built",
       "status": "pass",
-      "seconds": 6,
+      "seconds": 7,
       "why": ""
     },
     {
@@ -140,22 +140,22 @@
       "code": "V4",
       "title": "every resource the mesh declared is true on the machine",
       "status": "pass",
-      "seconds": 11,
+      "seconds": 13,
       "why": ""
     },
     {
       "code": "E1",
       "title": "a change to a module's source reaches the machine on its own",
       "status": "pass",
-      "seconds": 13,
+      "seconds": 12,
       "why": ""
     },
     {
       "code": "E2",
       "title": "the mesh comes back after the machine reboots",
-      "status": "fail",
-      "seconds": 31,
-      "why": "every container came back and no host agent did, so the machine is running the right things and can no longer be told anything:\namqp-ping\tUp 3 seconds\nmesh-lavinmq\tUp 3 seconds\nlavinmq\tUp 4 seconds (health: starting)\nmesh-control\tUp 3 seconds\nmesh-catalog\tUp 1 second\nmesh-postgres\tUp 4 seconds\npostgres\tUp 3 seconds\nmesh-builder\tUp 2 seconds\nmesh-registry\tUp 3 seconds\nmesh-broker\tUp 3 seconds (health: starting)\nmesh-store\tUp 3 seconds\n"
+      "status": "pass",
+      "seconds": 33,
+      "why": ""
     }
   ]
 }