Rename mesh-control -> mesh-controller, substrate -> foundation

One name per thing, per the HQ glossary: the module/container/image/binary/repo
becomes mesh-controller, the seat the-controller, and the store+broker pair the
foundation (embedded base bundles, default template and example lock renamed with
their go:embed directives). No behaviour change — a pure vocabulary rename.

Claude-Session: https://claude.ai/code/session_01D6qtiYU3P9jk3pnAXyAFyx

src/broker-amqp.ts

@@ -38,7 +38,7 @@ export interface Credential {
  * Connect to the mesh broker and return a Broker. `close()` tears both channel and connection down.
  *
  * A scoped module (novox/hq ADR 0043) passes `assumeExchanges: true`: its account may not declare
- * an exchange, and the substrate already owns them, so it declares only its own queue. A credential
+ * an exchange, and the foundation already owns them, so it declares only its own queue. A credential
  * carrying a fingerprint is dialled over amqps, pinned to exactly that certificate.
  */
 export async function connectAmqp(
@@ -55,9 +55,9 @@ export async function connectAmqp(
   // at-least-once starts at the emitter, not only the consumer (ADR 0042).
   const ch = await conn.createConfirmChannel();
 
-  // The substrate owns the exchanges (ADR 0043). A bootstrap/admin connection declares them; a
+  // The foundation owns the exchanges (ADR 0043). A bootstrap/admin connection declares them; a
   // scoped module assumes they exist and never tries — its account could not, and the dead-letter
-  // queue behind the exchange is the substrate's to keep, not a module's.
+  // queue behind the exchange is the foundation's to keep, not a module's.
   if (!opts.assumeExchanges) {
     await ch.assertExchange(RPC_EXCHANGE, "topic", { durable: true });
     await ch.assertExchange(EVENTS_EXCHANGE, "topic", { durable: true });

src/main.ts

@@ -32,7 +32,7 @@ import { emit } from "@novox/mesh-sdk/events";
 
 /**
  * Connect the way this process is meant to: with its sealed credential if the mesh gave it one, and
- * over the plain bootstrap URL otherwise. A scoped module assumes the substrate's exchanges exist —
+ * over the plain bootstrap URL otherwise. A scoped module assumes the foundation's exchanges exist —
  * its account may not declare them (ADR 0043).
  */
 async function connectBroker(): Promise<Broker> {