Added

• Built-in qwen_code engine (aliases qwen-code, qwen), backed by the
  Qwen Code CLI (@qwen-code/qwen-code).
  Installed on demand via npm (Node.js bootstrapped automatically) and run
  non-interactively with qwen --yolo -p <instruction>. Authenticates against
  any OpenAI-compatible endpoint through OPENAI_API_KEY / OPENAI_BASE_URL,
  with engine.model.name / --model forwarded as both the -m flag and
  OPENAI_MODEL; MCP servers install via qwen mcp add.
• Custom Engine http transport (engine.custom.transport: http): calls a
  remote (or local) HTTP agent service, POSTing the SessionInput and parsing
  the SessionResult from the response. Renders ${...} references in
  http.url / http.headers / http.request_body; a request_body field
  whose value is exactly ${session_input}, ${messages}, or ${kwargs} is
  injected as a JSON structure rather than a string. A non-2xx status is treated
  as an engine execution error, and the API key is rejected in the URL (use a
  header or the request body instead) and masked in responses.
• Custom Engine http transport multipart file upload (engine.custom.http.files):
  when files are declared the request becomes multipart/form-data — the JSON
  body is sent as the payload field and each matched workspace file as a
  files part (the part filename is the workspace-relative path). Paths may be
  exact or doublestar globs (*, **), are confined to the workspace, and only
  regular files are uploaded; required: true (the default) errors when an
  entry matches nothing, required: false skips it.
• Custom Engine: download artifacts.files[].url artifacts into the report. A
  result that declares a downloadable url is fetched (http/https only) and
  written into the case artifact directory under name. The download is
  best-effort and bounded (256 MB cap, request timeout): a non-2xx status,
  transport error, non-http(s) scheme, or over-cap body is logged and skipped
  without failing the run. A URL embedding the configured API key is refused, and
  logged errors are scrubbed of the configured api_key / engine.custom.env
  secrets.