Doctor plugin checks: implement health check classes and documentation

Implement remediation-aware health checks across all Doctor plugin modules
(Agent, Attestor, Auth, BinaryAnalysis, Compliance, Crypto, Environment,
EvidenceLocker, Notify, Observability, Operations, Policy, Postgres, Release,
Scanner, Storage, Vex) and their backing library counterparts (AI, Attestation,
Authority, Core, Cryptography, Database, Docker, Integration, Notify,
Observability, Security, ServiceGraph, Sources, Verification).

Each check now emits structured remediation metadata (severity, category,
runbook links, and fix suggestions) consumed by the Doctor dashboard
remediation panel.

Also adds:
- docs/doctor/articles/ knowledge base for check explanations
- Advisory AI search seed and allowlist updates for doctor content
- Sprint plan for doctor checks documentation

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

docs/doctor/articles/notify/email-configured.md

@@ -0,0 +1,86 @@
+---
+checkId: check.notify.email.configured
+plugin: stellaops.doctor.notify
+severity: warn
+tags: [notify, email, smtp, quick, configuration]
+---
+# Email Configuration
+
+## What It Checks
+Verifies that the email (SMTP) notification channel is properly configured. The check reads the `Notify:Channels:Email` configuration section and validates:
+
+- **SMTP host** (`SmtpHost` or `Host`): must be set and non-empty.
+- **SMTP port** (`SmtpPort` or `Port`): must be a valid number between 1 and 65535.
+- **From address** (`FromAddress` or `From`): must be set so outbound emails have a valid sender.
+- **Enabled flag** (`Enabled`): if explicitly set to `false`, reports a warning that the channel is configured but disabled.
+
+The check only runs when the `Notify:Channels:Email` configuration section exists.
+
+## Why It Matters
+Email notifications deliver critical alerts for release gate failures, policy violations, and security findings. Without a properly configured SMTP host, no email notifications can be sent, leaving operators blind to events that require immediate action. A missing from-address causes emails to be rejected by receiving mail servers.
+
+## Common Causes
+- SMTP host not set in configuration
+- Missing `Notify:Channels:Email:SmtpHost` setting
+- SMTP port not specified or set to an invalid value
+- From address not configured
+- Email channel explicitly disabled in configuration
+
+## How to Fix
+
+### Docker Compose
+Add environment variables to your service definition:
+
+```yaml
+environment:
+  Notify__Channels__Email__SmtpHost: "smtp.example.com"
+  Notify__Channels__Email__SmtpPort: "587"
+  Notify__Channels__Email__FromAddress: "noreply@example.com"
+  Notify__Channels__Email__UseSsl: "true"
+```
+
+### Bare Metal / systemd
+Edit `appsettings.json`:
+
+```json
+{
+  "Notify": {
+    "Channels": {
+      "Email": {
+        "SmtpHost": "smtp.example.com",
+        "SmtpPort": 587,
+        "FromAddress": "noreply@example.com",
+        "UseSsl": true
+      }
+    }
+  }
+}
+```
+
+Restart the service:
+```bash
+sudo systemctl restart stellaops-notify
+```
+
+### Kubernetes / Helm
+Set values in your Helm `values.yaml`:
+
+```yaml
+notify:
+  channels:
+    email:
+      smtpHost: "smtp.example.com"
+      smtpPort: 587
+      fromAddress: "noreply@example.com"
+      useSsl: true
+      credentialsSecret: "stellaops-smtp-credentials"
+```
+
+## Verification
+```
+stella doctor run --check check.notify.email.configured
+```
+
+## Related Checks
+- `check.notify.email.connectivity` — tests whether the configured SMTP server is reachable
+- `check.notify.queue.health` — verifies the notification delivery queue is healthy