Rename mesh-control -> mesh-controller, substrate -> foundation

One name per thing, per the HQ glossary: the module/container/image/binary/repo
becomes mesh-controller, the seat the-controller, and the store+broker pair the
foundation (embedded base bundles, default template and example lock renamed with
their go:embed directives). No behaviour change — a pure vocabulary rename.

Claude-Session: https://claude.ai/code/session_01D6qtiYU3P9jk3pnAXyAFyx

scenarios/whole-mesh-ace.yml

@@ -1,15 +1,15 @@
 # The whole `ace` server's converted service set, installed together on ONE node behind the mesh
-# substrate — the media/home-automation half of the whole-mesh rehearsal (novox/hq). Sibling of
+# foundation — the media/home-automation half of the whole-mesh rehearsal (novox/hq). Sibling of
 # scenarios/whole-mesh-novox.yml; same topology, a different (larger, media-heavy) module set.
 #
-# Substrate (store, broker, control) rides `anchor` and NOTHING else; ALL of ace's services ride the
+# Foundation (store, broker, control) rides `anchor` and NOTHING else; ALL of ace's services ride the
 # `ace` node. An overlay is placed so the two DB consumers (baserow, letta) reach the postgres/redis
 # providers co-located with them. The media stack (sonarr/radarr/lidarr/plex/bazarr/nzbget/
 # qbittorrent/bookshelf) shares the operator-owned library directories under /services/media (ADR
 # 0051 `accesses`); the test pre-creates them on the node, as the operator would, before the push —
 # the mesh confirms the paths exist and mounts them, but creates and chowns none of it.
 #
-#   MESH_LAB_HOST_BINARY=.../mesh-host   MESH_LAB_BUNDLE=.../examples/substrate-first-node.lock
+#   MESH_LAB_HOST_BINARY=.../mesh-host   MESH_LAB_BUNDLE=.../examples/foundation-first-node.lock
 # The runtimes are built by scripts/build-module-runtime.sh (one per module) and must be in the local
 # daemon, because nothing serves them and nothing can. Every media/app image is pulled from the
 # internet by the node itself, over its uplink, by the digest its module.json already pins. The test
@@ -30,9 +30,9 @@ machines:
     memory: 4GiB
     cpus: 4
     disk: 20GiB
-    # The substrate only, so the control plane's image only. The runtimes belong on the node that
+    # The foundation only, so the control plane's image only. The runtimes belong on the node that
     # runs the modules, and a 20GiB disk has no room for them anyway.
-    images: [mesh-control:development]
+    images: [mesh-controller:development]
   # The whole ace service set — 24 modules, ~50 containers, several heavy (Plex, Home Assistant,
   # Letta ~1.8GiB, Baserow ~1.5GiB, the UniFi controller's JVM, mssql ~2GiB). Sized past novox.
   ace:
@@ -42,7 +42,7 @@ machines:
     memory: 18GiB
     cpus: 8
     disk: 120GiB
-    # Every runtime. Not mesh-control: the control plane runs on the anchor.
+    # Every runtime. Not mesh-controller: the control plane runs on the anchor.
     images:
       - mesh-runtime-postgres:development
       - mesh-runtime-redis:development
@@ -70,7 +70,7 @@ machines:
       - mesh-runtime-unifi:development
 
 images:
-  - mesh-control:development
+  - mesh-controller:development
   # The per-module runtimes (built by scripts/build-module-runtime.sh).
   - mesh-runtime-postgres:development
   - mesh-runtime-redis:development