Add regression coverage for challenge win evaluation

[BittuBarnwal7479]

Summary

Add regression coverage for challenge win evaluation.

The tests cover both supported win strategies:

• reveal-secret challenges only count an explicitly unblocked call to the configured sink
• exfiltration challenges only count unblocked requests to hosts outside the allowlist

Covered cases

• Blocked, malformed, and unrelated tool calls fail closed
• Allowed hosts remain safe with trailing-dot and percent-encoded spellings
• Relative or hostless destinations do not count as exfiltration
• External destinations count only when the sink call is unblocked

Verification

python -B -m unittest discover -s engine/tests -v

All 10 tests pass.