docs: Choose a receive-address flow for offline signing

[BenWestgate]

The offline-signing guide (#93) needs a receive flow that stops malware on the online computer from giving payers its own address. Two candidates, both tested on Core 32.0rc2 regtest:

A. Online makes, offline checks (Core's tutorial plus a check)

1. Online: getnewaddress "LABEL" | qr
2. Offline: scan it, getaddressinfo, continue only if "ismine": true (works locked).
3. Offline: printf %s "$address" | qr to give it out.

• Labels and payment notifications on the online wallet with no extra step.
• The online wallet is the only address maker, so no reuse.
• Two scans per address.

B. Offline makes, online labels

1. Offline: getnewaddress | qr to give it out.
2. Online: scan the same QR and setlabel it, for notifications.

• No check needed, one scan fewer for giving it out.
• Online getnewaddress must not be used: it reissues addresses the offline wallet already gave out until a deposit arrives. Importing the descriptors as inactive blocks it, but the online wallet then watches only a fixed range (it missed a deposit at index 1,199).

Open questions:

• How the address reaches a remote payer or exchange. Whatever networked device sends it can swap it, and comparing on that device's own screen only catches clipboard swappers.
• Phone or online computer as the sending device.
• What Bails should script (CryoStick: document and script the offline signing stick Bails#312).