Doctor plugin checks: implement health check classes and documentation

Implement remediation-aware health checks across all Doctor plugin modules
(Agent, Attestor, Auth, BinaryAnalysis, Compliance, Crypto, Environment,
EvidenceLocker, Notify, Observability, Operations, Policy, Postgres, Release,
Scanner, Storage, Vex) and their backing library counterparts (AI, Attestation,
Authority, Core, Cryptography, Database, Docker, Integration, Notify,
Observability, Security, ServiceGraph, Sources, Verification).

Each check now emits structured remediation metadata (severity, category,
runbook links, and fix suggestions) consumed by the Doctor dashboard
remediation panel.

Also adds:
- docs/doctor/articles/ knowledge base for check explanations
- Advisory AI search seed and allowlist updates for doctor content
- Sprint plan for doctor checks documentation

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

docs/doctor/articles/notify/teams-connectivity.md

@@ -0,0 +1,60 @@
+---
+checkId: check.notify.teams.connectivity
+plugin: stellaops.doctor.notify
+severity: warn
+tags: [notify, teams, connectivity, network]
+---
+# Teams Connectivity
+
+## What It Checks
+Verifies that the configured Microsoft Teams webhook endpoint is reachable. The check:
+
+- Sends a minimal Adaptive Card payload to the webhook URL with a 10-second timeout.
+- Passes if the response is successful (HTTP 2xx).
+- Warns if an unexpected HTTP status is returned (invalid, expired, or revoked webhook).
+- Fails on connection timeout or HTTP request exceptions.
+
+The check only runs when `Notify:Channels:Teams:WebhookUrl` is set and is a valid absolute URL.
+
+## Why It Matters
+An unreachable Teams webhook means notifications silently fail to deliver. Operations teams will miss release alerts and security findings if the webhook is broken.
+
+## Common Causes
+- Invalid or expired webhook URL
+- Teams connector disabled or deleted
+- Microsoft 365 tenant configuration changed
+- Firewall blocking outbound HTTPS to webhook.office.com
+- Proxy configuration required
+
+## How to Fix
+
+### Docker Compose
+```bash
+docker exec <notify-container> curl -v https://webhook.office.com/
+```
+
+### Bare Metal / systemd
+```bash
+curl -v https://webhook.office.com/
+curl -H 'Content-Type: application/json' \
+  -d '{"text":"Doctor test"}' \
+  'https://YOUR_TENANT.webhook.office.com/webhookb2/...'
+```
+
+Check Microsoft 365 service status at https://status.office.com.
+
+### Kubernetes / Helm
+```bash
+kubectl exec -it <notify-pod> -- curl -v https://webhook.office.com/
+```
+
+If the webhook is broken, recreate it: Teams channel > Connectors > Incoming Webhook > delete and recreate.
+
+## Verification
+```
+stella doctor run --check check.notify.teams.connectivity
+```
+
+## Related Checks
+- `check.notify.teams.configured` — verifies Teams webhook URL is set and valid
+- `check.notify.queue.health` — verifies the notification delivery queue is healthy