Why: card and PR description are one document; the PR link and the user's authorization basis must be on the branch before merge. Evidence: Dev PR #325 created via Gitea API; user directive 2026-10-11 quoted in the card. Impact: task metadata only. Refs: PR #325.