Rename mesh-control -> mesh-controller, substrate -> foundation

One name per thing, per the HQ glossary: the module/container/image/binary/repo
becomes mesh-controller, the seat the-controller, and the store+broker pair the
foundation (embedded base bundles, default template and example lock renamed with
their go:embed directives). No behaviour change — a pure vocabulary rename.

Claude-Session: https://claude.ai/code/session_01D6qtiYU3P9jk3pnAXyAFyx

src/pinning.ts

@@ -3,7 +3,7 @@
  *
  * **A digest is not knowable until something is built** (novox/hq 04-ISSUES/025). A manifest in a
  * repository can pin a third-party image, because somebody can ask a registry what a tag points
- * at. It cannot pin an image the mesh builds itself: mesh-control, mesh-builder, mesh-route-proxy,
+ * at. It cannot pin an image the mesh builds itself: mesh-controller, mesh-builder, mesh-route-proxy,
  * the per-module runtimes and the provisioners exist in no registry, so there is no manifest
  * digest to write down. The catalogue ships sixty-four zeros for them, which parses, resolves,
  * composes — and stops on the machine.
@@ -54,7 +54,7 @@ export function repositoryOf(reference: string): string {
  *
  * **Derived from the shape the build produces, not from a list of names.** `make image
  * builder-image provisioner-image objectstore-image redis-provisioner-image proxy-image` in
- * mesh-control and `scripts/build-module-runtime.sh` here both tag their output `mesh-<something>`
+ * mesh-controller and `scripts/build-module-runtime.sh` here both tag their output `mesh-<something>`
  * with no registry host and no upstream organisation — that is what "built here, published
  * nowhere" looks like, and a hardcoded list would go stale the first time a module is added.
  *