docs: point at Dozor for advisory-driven curation

NORA keeps no advisory database by design (ADR-2). The non-goal in
ARCHITECTURE.md now says where advisory-driven curation actually lives instead
of leaving a dead end, and the README gains a short Companion section.

Only what exists today is claimed: Dozor covers npm.

Author: devitway

ARCHITECTURE.md

@@ -476,6 +476,9 @@ external tools (Grafana dashboards, git-based rule management).
   deploy them.
 - **Not a vulnerability scanner.** Curation blocks known-bad packages.
   For CVE scanning of your own artifacts, use Trivy, Grype, or similar.
+  NORA keeps no advisory database (ADR-2); to drive the blocklist from
+  advisory data, [Dozor](https://github.com/getnora-io/dozor) compiles the OSV
+  feed and a registry inventory into a blocklist file NORA reads as-is.
 - **Not a package builder.** NORA does not compile source code into
   packages. Use `cargo publish`, `npm publish`, `mvn deploy` to create
   artifacts, then push them to NORA.

README.md

@@ -186,6 +186,14 @@ See [SECURITY.md](SECURITY.md) for vulnerability reporting.
 
 Full documentation: **https://getnora.dev**
 
+## Companion
+
+[**Dozor**](https://github.com/getnora-io/dozor) writes NORA's curation
+blocklist. It compiles the OSV advisory feed together with an inventory of what
+your registry actually holds into a `blocklist.json`, and NORA enforces it — no
+NORA configuration beyond `curation.blocklist_path`, and no changes to NORA
+itself. Separate binary, separate repository, MIT.
+
 ## Author
 
 Created and maintained by [Pavel Volkov](https://github.com/devitway)