Rename mesh-control -> mesh-controller, substrate -> foundation

One name per thing, per the HQ glossary: the module/container/image/binary/repo
becomes mesh-controller, the seat the-controller, and the store+broker pair the
foundation (embedded base bundles, default template and example lock renamed with
their go:embed directives). No behaviour change — a pure vocabulary rename.

Claude-Session: https://claude.ai/code/session_01D6qtiYU3P9jk3pnAXyAFyx

src/lifecycle/egress.ts

@@ -7,7 +7,7 @@
  * from the internet, and that is now the thing worth proving before a raise says it is finished.
  *
  * The failure it exists to stop is the same one, in the same shape: `raise` returns, the caller
- * applies a substrate, the first pull fails, no node enrols, and the instance is left a bare
+ * applies a foundation, the first pull fails, no node enrols, and the instance is left a bare
  * shell — with the cause several steps back and looking like a mesh fault rather than a lab one.
  *
  * Two things are checked, in this order, because they fail differently and the difference is the

src/lifecycle/place.ts

@@ -5,7 +5,7 @@
  * the thing it exists to test did not exist (novox/hq 03-DESIGN/00-as-is/11-the-lab.md). Tier
  * 0 now does, so this is the seam where the lab acquires a consumer.
  *
- * Only `host` is placeable. Everything else in the placement vocabulary — the substrate, a
+ * Only `host` is placeable. Everything else in the placement vocabulary — the foundation, a
  * control plane, a forge — is still refused by name rather than ignored, because a scenario
  * that declares something and raises without it is the fault this lab was built to catch
  * (novox/hq 04-ISSUES/003).
@@ -515,7 +515,7 @@ export async function loadHeldImages(
       throw new Error(
         `${requested} is not on this workstation, so there is nothing to hand the machines.\n` +
           `  It is one of the mesh's own images and exists in no registry — nothing can pull it.\n` +
-          `  Build it first (mesh-control's \`make image …\`, or scripts/build-module-runtime.sh).`,
+          `  Build it first (mesh-controller's \`make image …\`, or scripts/build-module-runtime.sh).`,
       );
     }
   }

src/lifecycle/raise.ts

@@ -338,7 +338,7 @@ export async function raise(
     // **Only now is "this machine can reach the outside" a true statement.** The route, the
     // gateway and the machine's own filtering are all in place, so this is the path a pull takes.
     // A raise that returned without checking would hand the next step a fact it depends on and
-    // has no way to test — which is how a substrate apply used to die on its first pull.
+    // has no way to test — which is how a foundation apply used to die on its first pull.
     enter("confirming egress reaches the internet");
     await confirmEgress(scenario, byMachine, log);
 

src/lifecycle/supported.ts

@@ -36,7 +36,7 @@ export function assertSupported(scenario: Scenario): void {
 
   // `host`, `runtime` and `image:<reference>` work. Everything else in the vocabulary is named
   // individually rather than refused as a whole, so a scenario that places a host and a
-  // substrate is told exactly which half the lab cannot do.
+  // foundation is told exactly which half the lab cannot do.
   const unplaceable = new Set<string>();
   for (const { artifacts } of planPlacements(scenario)) {
     for (const artifact of artifacts) {