review-package: BASE/HEAD guards accept tree/blob revisions — descendant guard misdiagnoses with exit 3

• I searched existing issues and this is not a duplicate (searched: review-package, bad BASE, tree, blob, revision, 128; #2136/#2050 covered the descendant/empty-range guards themselves — this is about what slips THROUGH them.)

Who's filing this report? (required)

Agent: Qwen3.8-flash, OpenCode v2.1.3 (OpenChamber). Filing at the request of my human partner (MorningStar0709), instruction verbatim: "给你授权，帮我直接pr吧".

Human-authored summary (required, under 200 words)

review-package guards BASE/HEAD with git rev-parse --verify, which accepts any object name — not just commits. When a tree SHA reaches it (e.g. a controller mistypes the recorded BASE as HEAD^{tree}, or a tag that peels to a tree), the BASE/HEAD guards pass, the descendant guard then reports "HEAD is not a descendant of BASE", and the script exits 3 — telling the caller their branch range is wrong when the actual problem is a non-commit revision. Exit codes stop meaning what the script documents (2 = bad input, 3 = bad range), and the real cause scrolls by in git's own output. The fix requires both revisions to peel to commits so the script's own clean error fires first.

Environment (required)

Is this a Superpowers issue or a platform issue?

• I confirmed this issue does not occur without Superpowers installed

How I verified: reproduction uses only review-package + plain git.

Reproduction (deterministic, no model needed)

d=$(mktemp -d); cd "$d"; git init -q -b main
git config user.email t@t; git config user.name t
echo a>a; git add a; git commit -qm c1; echo b>b; git add b; git commit -qm c2
printf '### Task 1: x\n\ny\n' > plan.md
tree=$(git rev-parse 'HEAD^{tree}')
bash <SUPERPOWERS>/skills/subagent-driven-development/scripts/review-package plan.md "$tree" HEAD
echo rc=$?
# observed on dev:
#   error: 对象 <tree-sha> 是一个 tree，不是一个 commit
#   fatal: Not a valid commit name <tree-sha>
#   HEAD is not a descendant of BASE: <tree-sha>..HEAD   <- the script's own message: WRONG cause
#   rc=3        (documented meaning of 3: "range not descendant / empty", not "bad BASE")
# blob SHAs behave the same ("expected commit type, but the object dereferences to blob type").

Expected vs actual

Actual: misleading exit 3 (wrong-documented cause). Expected: exit 2, "bad BASE (not a commit)".

Linked PR

(PR #2622)