Doctor plugin checks: implement health check classes and documentation

Implement remediation-aware health checks across all Doctor plugin modules
(Agent, Attestor, Auth, BinaryAnalysis, Compliance, Crypto, Environment,
EvidenceLocker, Notify, Observability, Operations, Policy, Postgres, Release,
Scanner, Storage, Vex) and their backing library counterparts (AI, Attestation,
Authority, Core, Cryptography, Database, Docker, Integration, Notify,
Observability, Security, ServiceGraph, Sources, Verification).

Each check now emits structured remediation metadata (severity, category,
runbook links, and fix suggestions) consumed by the Doctor dashboard
remediation panel.

Also adds:
- docs/doctor/articles/ knowledge base for check explanations
- Advisory AI search seed and allowlist updates for doctor content
- Sprint plan for doctor checks documentation

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

docs/doctor/articles/notify/webhook-configured.md

@@ -0,0 +1,68 @@
+---
+checkId: check.notify.webhook.configured
+plugin: stellaops.doctor.notify
+severity: warn
+tags: [notify, webhook, quick, configuration]
+---
+# Webhook Configuration
+
+## What It Checks
+Verifies that the generic webhook notification channel is properly configured. The check reads `Notify:Channels:Webhook` and validates:
+
+- **URL** (`Url` or `Endpoint`): must be set and be a valid HTTP or HTTPS URL.
+- **Enabled flag** (`Enabled`): if explicitly `false`, reports a warning.
+- Also reads `Method` (defaults to POST) and `ContentType` (defaults to application/json) for evidence.
+
+The check only runs when the `Notify:Channels:Webhook` configuration section exists.
+
+## Why It Matters
+Generic webhooks integrate Stella Ops notifications with third-party systems (PagerDuty, OpsGenie, custom dashboards, SIEM tools). A missing or malformed URL prevents these integrations from receiving events.
+
+## Common Causes
+- Webhook URL not set in configuration
+- Malformed URL (missing protocol `http://` or `https://`)
+- Invalid characters in URL
+- Webhook channel explicitly disabled
+
+## How to Fix
+
+### Docker Compose
+```yaml
+environment:
+  Notify__Channels__Webhook__Url: "https://your-endpoint/webhook"
+  Notify__Channels__Webhook__Method: "POST"
+  Notify__Channels__Webhook__ContentType: "application/json"
+```
+
+### Bare Metal / systemd
+```json
+{
+  "Notify": {
+    "Channels": {
+      "Webhook": {
+        "Url": "https://your-endpoint/webhook",
+        "Method": "POST",
+        "ContentType": "application/json"
+      }
+    }
+  }
+}
+```
+
+### Kubernetes / Helm
+```yaml
+notify:
+  channels:
+    webhook:
+      url: "https://your-endpoint/webhook"
+      method: "POST"
+```
+
+## Verification
+```
+stella doctor run --check check.notify.webhook.configured
+```
+
+## Related Checks
+- `check.notify.webhook.connectivity` — tests whether the webhook endpoint is reachable
+- `check.notify.queue.health` — verifies the notification delivery queue is healthy