Rename mesh-control -> mesh-controller, substrate -> foundation

One name per thing, per the HQ glossary: the module/container/image/binary/repo
becomes mesh-controller, the seat the-controller, and the store+broker pair the
foundation (embedded base bundles, default template and example lock renamed with
their go:embed directives). No behaviour change — a pure vocabulary rename.

Claude-Session: https://claude.ai/code/session_01D6qtiYU3P9jk3pnAXyAFyx

provisioners/README.md

@@ -39,7 +39,7 @@ must reach the same state from wherever it starts. That means, in order:
 Step 2 is the half usually missing, and it is the same rule the host follows about removing what
 it declared and no longer declares.
 
-The reference implementation lives in `mesh-control/examples/postgres-provisioner`, because that
+The reference implementation lives in `mesh-controller/examples/postgres-provisioner`, because that
 is where the contract is defined and where the language is already set up to read it. The lab's
 job is the other half: raising a real PostgreSQL and proving that what the mesh delivered becomes
 a login that works, a rotation that takes effect, and a revocation that bites.