docs(reviews/2026-07-03): fix P4 staleness — sweep status blocks + re-aim fuzz

Adversarial review finding P4: README §Status block (and the mid-file
callout) still said 'Slice 1 is the active build target' directly beneath
a slice-3 quickstart. The same §Status block is verbatim in
docs/QUICKSTART.md + docs/DEVELOPMENT.md, so fixing one without the
others would re-corrupt agent context on next read — swept all three.

fuzz/README.md planned for the SIP/SDP parsers that ADR-0007 abolished.
Re-aimed at the actual post-0007 hostile-byte surfaces: tap protocol
frames (existing, slice-2), RTP at the str0m input, Opus payload at the
decoder boundary, and the provider media-fork framing (step 5, deferred).

Refs docs/reviews/2026-07-03-adversarial-review.md P4. DCO-signed.

Signed-off-by: Aaron D. Lee <himself@adlee.work>

docs/DEVELOPMENT.md

@@ -3,11 +3,11 @@
 The dev loop: how to iterate on the Rust workspace, run tests, and find
 your way around the codebase.
 
-> **Status:** Slice 1 is the active build target. The workspace is
-> landing task-by-task on the `slice-1-webrtc-loopback` branch. Once it
-> merges to `main`, everything below applies directly. Until then,
-> `git checkout slice-1-webrtc-loopback` to follow along.
-> Implementation plan: [`docs/superpowers/plans/2026-06-28-slice-1-webrtc-loopback.md`](superpowers/plans/2026-06-28-slice-1-webrtc-loopback.md).
+> **Status:** Slices 1–3 are merged to `main`. Slice 4 (barge-in / VAD-driven playout
+> kill) is the active build target, in flight on the `slice-4-dev-a-reflex` +
+> `slice-4-dev-b-tap` branches. Everything below applies to the merged code on
+> `main`; to follow slice-4 in flight, check out either dev branch.
+> Implementation plan: [`docs/superpowers/plans/2026-07-01-slice-4-barge-in.md`](superpowers/plans/2026-07-01-slice-4-barge-in.md).
 
 ---