PM-5161: Guard MM winner fallback final scoring

[jmgasper]

What was broken

Marathon Match close could still persist winners from an incomplete set of final summations when latest submission rows were unavailable to challenge-api. In that fallback path, an older or partial final score could be selected before another submitter's latest known summation had a final score.

Root cause (if identifiable)

The previous fix guarded the direct latest-submission path, but the no-submission-row fallback still ranked the newest final summation per submitter without checking whether Review API already showed a newer submission-scoped summation for that submitter.

What was changed

The fallback winner selection now derives the newest submission-scoped summation per submitter from all review summations. If that latest known submission does not have the selected final summation, closeMarathonMatch rejects the close instead of persisting premature winners.

Any added/updated tests

Added ChallengeService unit coverage for blocking fallback winner selection when a submitter has an older final summation and a newer non-final submission-scoped summation.

Validation notes:

• pnpm lint passed.
• The exact new regression test passed.
• node --check and git diff --check passed.
• pnpm build could not run because this repo has no build script.
• pnpm test is blocked before this change by test/unit/challenge-helper.test.js referencing an undefined chai global.
• The broader close marathon match focused test reaches this change; the new regression and existing blocking cases pass, while existing close success cases are blocked by missing Auth0/M2M test config.