docs: the sentences the rewrite reviews left as follow-up notes (closes #723)

Each sentence named on #723 now
matches the code on `next`:

- the Firefox load steps are numbered;
- the AddToken refusal lists name a token that fakes a known symbol;
- the worker's in-memory state is listed in full;
- `script/bootstrap` falls back to `npm install -g` for yarn;
- the Send line under a `null` ETH balance holds with ETH selected, and
  "Max" has a line of its own;
- the Home and Send lines there name `SepoliaETH` on Sepolia;
- the well-known symbols are given per network;
- a network switch empties the fraud contract list;
- the cases where an import leaves out a removed address are spelled out;
- a new token's line depends on "Show tracked tokens with zero balance";
- wallet drainer is defined at first use only.

Model: fable-5-1

README.md

@@ -89,9 +89,13 @@ Load it:
     2. Turn on "Developer mode".
     3. Click "Load unpacked".
     4. Pick `dist/chrome/`.
-- Firefox: open `about:debugging#/runtime/this-firefox`, click "Load Temporary
-  Add-on" and pick `dist/firefox/manifest.json`. A temporary add-on is unloaded
-  when Firefox exits. Read Installing on Firefox below before relying on it.
+- Firefox:
+    1. Open `about:debugging#/runtime/this-firefox`.
+    2. Click "Load Temporary Add-on".
+    3. Pick `dist/firefox/manifest.json`.
+
+A temporary add-on is unloaded when Firefox exits. Read Installing on Firefox
+below before relying on it.
 
 The user guide, [`docs/README.md`](docs/README.md), explains how to use the
 wallet. The release procedure is in [`docs/RELEASE.md`](docs/RELEASE.md).
@@ -375,12 +379,18 @@ Three rules follow from the worker being stopped:
   worker stopping. Such a connection ends when the browser closes, when the
   active address changes, or when the site is removed in Settings.
 
-Two things live only in the worker's memory and are lost when it stops: pending
-approvals and the record of broadcast nonces. An approval, and the site's
-request waiting on it, exist nowhere else. So while any approval is pending, the
-worker calls `runtime.getPlatformInfo()` every 20 seconds. Chrome counts that
-call as activity and keeps the worker running. The timer stops itself once
-nothing is pending.
+These things live only in the worker's memory and are lost when it stops:
+
+- pending approvals;
+- the record of broadcast nonces;
+- the timer that keeps the worker running while an approval is pending;
+- the record of the one open transaction approval;
+- the job that sets up the alarms at every start, while it runs.
+
+An approval, and the site's request waiting on it, exist nowhere else. So while
+any approval is pending, the worker calls `runtime.getPlatformInfo()` every 20
+seconds. Chrome counts that call as activity and keeps the worker running. The
+timer stops itself once nothing is pending.
 
 Alarms the code no longer handles are listed in `OBSOLETE_ALARMS` and cleared on
 every start. The worker fetches nothing when it starts.
@@ -903,7 +913,8 @@ not change. A flash message refuses:
 
 - a token already tracked;
 - an address on the scam list;
-- a contract that fails the lookup.
+- a contract that fails the lookup;
+- a token that fakes a known symbol.
 
 A network switch before the lookup answers adds nothing, and a flash message
 says so.
@@ -1224,8 +1235,12 @@ holds for a new address, and for every address after a network switch. While it
 is `null`:
 
 - the balance lists show "quantity unknown";
-- Home's ETH balance reads `unknown (ETH)`;
-- Send reads `Current balance: unknown (ETH)`, and "Max" fills in nothing;
+- Home's ETH balance reads `unknown (ETH)` on mainnet and `unknown (SepoliaETH)`
+  on Sepolia;
+- with ETH selected, Send reads `Current balance: unknown (ETH)` on mainnet and
+  `Current balance: unknown (SepoliaETH)` on Sepolia;
+- with ETH selected, "Max" fills in nothing and shows the flash message "This
+  token's balance is unknown.";
 - "Send" is not refused for a zero balance;
 - the address has no total;
 - DeleteAddress shows its warning.
@@ -1725,7 +1740,9 @@ The `Makefile` targets are thin shims over `script/`:
 
 - `script/bootstrap`: install the dependencies. Node and yarn come from the
   system when present. Otherwise node comes from a pinned nvm install and yarn
-  from corepack. Fails when node cannot find a package named in `package.json`.
+  from corepack. When corepack and nvm are both missing, yarn comes from
+  `npm install -g`. Fails when node cannot find a package named in
+  `package.json`.
 - `script/setup`: `script/bootstrap`, then the git pre-commit hook.
 - `script/test`: build the `test` stage of the `Dockerfile` with `--no-cache`.
   The stage runs the jest suite, stopped at 90 seconds and rerun verbose on