Rename mesh-control -> mesh-controller, substrate -> foundation

One name per thing, per the HQ glossary: the module/container/image/binary/repo
becomes mesh-controller, the seat the-controller, and the store+broker pair the
foundation (embedded base bundles, default template and example lock renamed with
their go:embed directives). No behaviour change — a pure vocabulary rename.

Claude-Session: https://claude.ai/code/session_01D6qtiYU3P9jk3pnAXyAFyx

scenarios/anthropic-bed.yml

@@ -8,10 +8,10 @@
 # The flow the test drives (OAuth stubbed, so it is the FLOW that is proven, not the vendor):
 #   the manager module seals the refresh token to the node's PUBLIC key  ->  the host unseals it and
 #   mounts the cleartext at the manager's bound path  ->  the manager calls the stub token endpoint  ->
-#   submits back only { access token, re-sealed box }  ->  mesh-control seals the access token per
+#   submits back only { access token, re-sealed box }  ->  mesh-controller seals the access token per
 #   consumer holder  ->  the consumer runtime writes ~/.claude/.credentials.json, access-token-only.
 #
-#   MESH_LAB_HOST_BINARY=.../mesh-host   MESH_LAB_BUNDLE=.../examples/substrate-first-node.lock
+#   MESH_LAB_HOST_BINARY=.../mesh-host   MESH_LAB_BUNDLE=.../examples/foundation-first-node.lock
 #   Build BOTH runtime images into the local daemon first (the scenario stocks and serves them by
 #   digest, which is where the host pulls them from):
 #     scripts/build-module-runtime.sh anthropic-manager  /tmp/anthropic-manager.tar
@@ -35,7 +35,7 @@ machines:
     cpus: 2
 
 images:
-  - mesh-control:development
+  - mesh-controller:development
   # The two model-access runtimes, built by scripts/build-module-runtime.sh into the local daemon and
   # loaded onto the machine, which holds them by their own image IDs.
   - mesh-runtime-anthropic-manager:development