Phase 1 MVP: drop-in step registry + session + Markdown report

Plugin skeleton, drop-in step registry, option-backed session, single-page
checklist UI, downloadable Markdown report. Steps live as one file each
under includes/steps/ — adding/removing one is a single file change.
Step IDs are stable strings so renaming files preserves session data.

Architecture (hc-5ix.3): WPH_Steps singleton globs includes/steps/*.php,
natsort-orders by filename, requires each file (which returns a WPH_Step
instance), then applies a 'wph_steps' filter so installs can drop steps.

Session (hc-5ix.4): option-backed (per decision — plugin is installed
per-engagement, so DB-resident history would be lost on uninstall).
Single in-progress session per site; finished sessions render a report
that the user downloads/copies.

Recovery bootstrap (hc-5ix.1): detects whether wp-site-recovery is
installed + active, surfaces state on the start panel and in every
active session. Manual install for now; private update channel deferred
to hc-5ix.27.

Smoke-tested on testsite: registry discovery (13 steps in correct order),
start → update_step → progress count → finish → 8KB Markdown report →
discard cycle.

README.md

@@ -0,0 +1,61 @@
+# Site Healthcheck
+
+Internal WordPress plugin that walks a technician through a structured healthcheck. Companion to [`wp-site-recovery`](../wp-site-recovery/), which it expects to be installed as step 0.
+
+## Install
+
+```sh
+ln -s ~/dev/wp-healthcheck /path/to/wp/wp-content/plugins/site-healthcheck
+```
+
+Then activate from *Plugins*. Settings appear under *Tools → Site Healthcheck*.
+
+## Use
+
+1. Open *Tools → Site Healthcheck*.
+2. Confirm the recovery plugin status panel shows ✓ active.
+3. Click **Start new healthcheck**.
+4. Work through each step card. For each: choose a status (done / skipped / blocked / n/a) and add notes.
+5. Click **Finish & generate report**.
+6. Download the Markdown report or copy it to clipboard.
+
+One in-progress session per site at a time. Reports are not stored in the database (the plugin is meant to be uninstalled at the end of each engagement) — download them.
+
+## Adding, removing, reordering steps
+
+Each step is a single file under `includes/steps/` named `<order>-<slug>.php`.
+
+```php
+<?php
+// includes/steps/45-staging.php
+return new class extends WPH_Step {
+    public function id(): string { return 'staging'; }
+    public function title(): string { return 'Step 4.5 — Verify Staging Sync'; }
+    public function sub_items(): array {
+        return ['Re-deploy from production', 'Run smoke tests'];
+    }
+};
+```
+
+- **Add:** drop a new file.
+- **Remove:** delete the file.
+- **Reorder:** rename the numeric prefix (steps are loaded in `natsort` order).
+- **Conditionally drop on one install:** use the `wph_steps` filter to `unset` the step by id.
+
+Stable string IDs (returned by `id()`) are what's stored in session data, so renaming a file does not break in-progress sessions as long as the id stays the same.
+
+## Phase roadmap
+
+Phase 1 (this) is a checklist + Markdown report. Phase 3 will add per-step automation — backup detection, env auto-collect, plugin update intelligence, PageSpeed Insights, SSL checks, etc. See beads epic `hc-5ix` for the full plan.
+
+## Distribution
+
+Internal/agency tool — not a WP.org plugin (decision `hc-5ix.26`). Distributed as a built ZIP. A self-hosted update channel is `hc-5ix.27` on the phase-3 backlog.
+
+## Tracking
+
+```sh
+cd ~/dev/wp-healthcheck
+bd list --label phase-1   # MVP work
+bd list --label phase-3   # automation backlog
+```