Rename mesh-control -> mesh-controller, substrate -> foundation

One name per thing, per the HQ glossary: the module/container/image/binary/repo
becomes mesh-controller, the seat the-controller, and the store+broker pair the
foundation (embedded base bundles, default template and example lock renamed with
their go:embed directives). No behaviour change — a pure vocabulary rename.

Claude-Session: https://claude.ai/code/session_01D6qtiYU3P9jk3pnAXyAFyx

src/declaration/types.ts

@@ -103,7 +103,7 @@ export interface Machine {
    * and a handful of containers.
    *
    * Declared, because it is a fact about the machine the scenario describes — the node that runs
-   * the whole substrate is bigger than the laptop that joins it, and a test that starves its
+   * the whole foundation is bigger than the laptop that joins it, and a test that starves its
    * anchor at the default answers questions about memory pressure, not about the mesh. The forge
    * test failed three times as "status hangs" before anyone counted the containers in 1GiB
    * (novox/hq 04-ISSUES/024 is the same lesson about a different resource).
@@ -158,7 +158,7 @@ export interface Scenario {
    * **The mesh's own images** — the ones that exist in no registry and are put onto a machine by
    * whoever built them.
    *
-   * mesh-control, mesh-builder, mesh-route-proxy, the per-module runtimes and the provisioners are
+   * mesh-controller, mesh-builder, mesh-route-proxy, the per-module runtimes and the provisioners are
    * built from source and published nowhere. A machine gets them the way an operator's machine
    * does: they are built on the workstation, loaded onto the machine, and named by the digest of
    * their own image configuration. Written as tags, because a tag is what `docker save` can