#1510 test(setup): the ready-made-engine refusal tests reach the checksum path on any PC

描述

`tools/test_setup_engine_hash.py`'s `WhatARefusalDoesToTheCaller` mocked the download and the published digest, but not
the two steps that come before the checksum, so on most PCs the run never reaches the path those two tests are about:

- `get_prebuilt` returns at once when this checkout's `engine/` holds a locally built engine (`"source": "local"`) -
  which any PC that ever ran `./setup.sh --build` has;
- before downloading it `HEAD`s the release asset over the real network, and no release carries this OS's asset.
  Measured 2026-10-08: `HEAD .../releases/latest/download/strata-linux-x64.zip` and
  `.../download/v0.1.40.3/strata-linux-x64.zip` both answer **404**, while `strata-windows-x64.zip` answers **200**.

Either way the run stops before `verify_engine_archive`, prints nothing, and the two tests fail with
`AssertionError: SystemExit not raised` and `'keeping the engine that is installed' not found in ''` - on Linux always,
on Windows on a checkout with a locally built engine.

What changes: the class now points `setup.engine_dir` at the `engine/` folder its own `setUp` already makes, and mocks
the `HEAD`; the first-install case goes through that same helper instead of patching two of the four steps. No fixture
versions and no setup.py behaviour are touched.

    python tools/test_setup_engine_hash.py     -> Ran 30 tests in 0.021s, OK   (was: FAILED (failures=2))

Offline (0.02 s, no request leaves the process), and it needs no `engine/` in the checkout. The other `tools/test_setup_*.py`
suites are unchanged and green.