Turns out the #microformats 2 JSON structures enable safe entity expansion just like twitter entities.
In my reply contexts I am not wanting to embed 3rd party HTML in my site, so I take the p-summary and strip tags. But, I want embedded h-cards to be expanded just like at-mentions on twitter. Pseudocode:
let h-card = canonical JSON structure for a note, with .summary as a plaintext representation of the content;
for item in h-card.children:
if not in_array('h-card', item.type) continue;
let html = HTML representation of the child from properties.url, name, etc;
replace item.value in h-card.summary with html