Rename mesh-control -> mesh-controller, substrate -> foundation

One name per thing, per the HQ glossary: the module/container/image/binary/repo
becomes mesh-controller, the seat the-controller, and the store+broker pair the
foundation (embedded base bundles, default template and example lock renamed with
their go:embed directives). No behaviour change — a pure vocabulary rename.

Claude-Session: https://claude.ai/code/session_01D6qtiYU3P9jk3pnAXyAFyx

src/lifecycle/egress.ts

@@ -7,7 +7,7 @@
  * from the internet, and that is now the thing worth proving before a raise says it is finished.
  *
  * The failure it exists to stop is the same one, in the same shape: `raise` returns, the caller
- * applies a substrate, the first pull fails, no node enrols, and the instance is left a bare
+ * applies a foundation, the first pull fails, no node enrols, and the instance is left a bare
  * shell — with the cause several steps back and looking like a mesh fault rather than a lab one.
  *
  * Two things are checked, in this order, because they fail differently and the difference is the