Doctor plugin checks: implement health check classes and documentation

Implement remediation-aware health checks across all Doctor plugin modules
(Agent, Attestor, Auth, BinaryAnalysis, Compliance, Crypto, Environment,
EvidenceLocker, Notify, Observability, Operations, Policy, Postgres, Release,
Scanner, Storage, Vex) and their backing library counterparts (AI, Attestation,
Authority, Core, Cryptography, Database, Docker, Integration, Notify,
Observability, Security, ServiceGraph, Sources, Verification).

Each check now emits structured remediation metadata (severity, category,
runbook links, and fix suggestions) consumed by the Doctor dashboard
remediation panel.

Also adds:
- docs/doctor/articles/ knowledge base for check explanations
- Advisory AI search seed and allowlist updates for doctor content
- Sprint plan for doctor checks documentation

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

docs/doctor/articles/timestamping/retimestamp-pending.md

@@ -0,0 +1,40 @@
+---
+checkId: check.timestamp.evidence.retimestamp.pending
+plugin: stellaops.doctor.timestamping
+severity: warn
+tags: [timestamping, evidence, retimestamp, queue]
+---
+# Retimestamp Pending
+
+## What It Checks
+Detects artifacts pending re-timestamping. Fails if the pending count exceeds the critical threshold (default 10), otherwise warns.
+
+## Why It Matters
+Pending retimestamp work means artifacts are at risk of losing their temporal proof. If retimestamping does not complete before the original timestamp expires, the evidence becomes unverifiable and may need to be regenerated from scratch.
+
+## Common Causes
+- Retimestamp queue processor not running
+- TSA endpoints unavailable during retimestamp attempts
+- Queue backlog from a large batch of expiring timestamps
+- Retimestamp job scheduling not configured
+
+## How to Fix
+Process the retimestamp queue:
+
+```bash
+stella retimestamp run
+
+# Schedule automatic processing
+stella retimestamp schedule create --interval daily
+```
+
+If TSA endpoints are down, resolve connectivity first (see `check.timestamp.tsa.reachable`).
+
+## Verification
+```
+stella doctor run --check check.timestamp.evidence.retimestamp.pending
+```
+
+## Related Checks
+- `check.timestamp.evidence.staleness` — aggregated evidence staleness check
+- `check.timestamp.tsa.reachable` — verifies TSA endpoints are reachable