Wire href to MDX routes or your CMS — cards stay layout-only.
Map CSS variables once; avoid duplicating :root blocks across apps.
Keep motion in client islands; prefer transitions for hovers.
What to attach beyond the README so security review stays painless.