Doctor plugin checks: implement health check classes and documentation

Implement remediation-aware health checks across all Doctor plugin modules
(Agent, Attestor, Auth, BinaryAnalysis, Compliance, Crypto, Environment,
EvidenceLocker, Notify, Observability, Operations, Policy, Postgres, Release,
Scanner, Storage, Vex) and their backing library counterparts (AI, Attestation,
Authority, Core, Cryptography, Database, Docker, Integration, Notify,
Observability, Security, ServiceGraph, Sources, Verification).

Each check now emits structured remediation metadata (severity, category,
runbook links, and fix suggestions) consumed by the Doctor dashboard
remediation panel.

Also adds:
- docs/doctor/articles/ knowledge base for check explanations
- Advisory AI search seed and allowlist updates for doctor content
- Sprint plan for doctor checks documentation

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

docs/doctor/articles/notify/slack-configured.md

@@ -0,0 +1,72 @@
+---
+checkId: check.notify.slack.configured
+plugin: stellaops.doctor.notify
+severity: warn
+tags: [notify, slack, quick, configuration]
+---
+# Slack Configuration
+
+## What It Checks
+Verifies that the Slack notification channel is properly configured. The check reads `Notify:Channels:Slack` and validates:
+
+- **Webhook URL** (`WebhookUrl`): must be set and non-empty.
+- **Enabled flag** (`Enabled`): if explicitly `false`, reports a warning that Slack is configured but disabled.
+
+The check only runs when the `Notify:Channels:Slack` configuration section exists.
+
+## Why It Matters
+Slack is a primary real-time notification channel for many operations teams. Without a configured webhook URL, security alerts, release gate notifications, and approval requests cannot reach Slack channels, delaying incident response.
+
+## Common Causes
+- Slack webhook URL not set in configuration
+- Missing `Notify:Channels:Slack:WebhookUrl` setting
+- Environment variable not bound to configuration
+- Slack notifications explicitly disabled
+
+## How to Fix
+
+### Docker Compose
+```yaml
+environment:
+  Notify__Channels__Slack__WebhookUrl: "https://hooks.slack.com/services/YOUR/WEBHOOK/URL"
+```
+
+> **Security note:** Slack webhook URLs are secrets. Store them in a secrets manager or Docker secrets, not in plain-text compose files.
+
+### Bare Metal / systemd
+Edit `appsettings.json`:
+
+```json
+{
+  "Notify": {
+    "Channels": {
+      "Slack": {
+        "WebhookUrl": "https://hooks.slack.com/services/YOUR/WEBHOOK/URL"
+      }
+    }
+  }
+}
+```
+
+### Kubernetes / Helm
+```yaml
+notify:
+  channels:
+    slack:
+      webhookUrlSecret: "stellaops-slack-webhook"
+```
+
+Create the secret:
+```bash
+kubectl create secret generic stellaops-slack-webhook \
+  --from-literal=url="https://hooks.slack.com/services/YOUR/WEBHOOK/URL"
+```
+
+## Verification
+```
+stella doctor run --check check.notify.slack.configured
+```
+
+## Related Checks
+- `check.notify.slack.connectivity` — tests whether the Slack webhook endpoint is reachable
+- `check.notify.queue.health` — verifies the notification delivery queue is healthy