docs: align voice studio upload contract

docs/superpowers/specs/2026-08-08-voice-studio-design.md

@@ -33,9 +33,9 @@ Voice files continue to live exclusively under `VOICES_DIR`.
 - `GET /v1/voices` returns safe metadata for each managed file: relative name,
   byte size, duration, sample rate, and channel count.
 - `POST /v1/voices` accepts a multipart `file` upload. The server sanitizes
-  the filename, rejects paths and collisions, accepts WAV only in this first
+  the filename for storage and display, rejects paths and collisions, accepts
-  release, validates that the decoded audio is nonempty, and saves inside
+  WAV only in this first release, validates that the decoded audio is nonempty,
-  `VOICES_DIR` only.
+  and saves inside `VOICES_DIR` only.
 - `DELETE /v1/voices/{name}` deletes one validated, regular file below
   `VOICES_DIR`; it rejects traversal, absolute paths, symlink escapes, and
   missing files.
@@ -51,9 +51,17 @@ before handing it to the model manager.
 ## Error handling and safety
 
 All API failures are JSON with a clear 4xx/5xx detail. The UI renders these as
-inline messages. Deletion requires a confirmation click but no login. The
+inline messages. Deletion requires a confirmation click but no login. Uploads
-upload limit is 20 MiB. Uploaded audio is never committed to Git; the existing
+are WAV only and capped at 20 MiB. Uploaded audio is never committed to Git;
-`voices/*` ignore rule remains in place.
+the existing `voices/*` ignore rule remains in place.
+
+## Rollout order
+
+1. Implement the voice-management API and its path-safety, validation, and
+   deletion tests.
+2. Update the speech endpoint only as needed to consume the stored relative
+   filename selected by the UI, retaining its OpenAI-compatible response.
+3. Add the two-column studio and wire it to the tested API.
 
 ## Verification