Is it possible to attack a one-time pad encrypting only slightly more than its length?
This does not look like OTP, but like PSK with conflicting extra steps.

Alice has her own entropy source.

And by definition, Bob does not have this same entropy source, so what Alice have is a random number generator. And since she cannot tell Bob if the bit is 0 or 1, Bob have no way to decrypt anything. And if she can tell, Eve can know too. And if Eve cannot know the content of the message, why don't use this secure channel to send the message instead of entropy?

A meddling Eve, if she knows how this protocol works

Eve always knows the protocol, the algorithm, all obfuscations, she only needs the key. That's the Kerckhoffs's principle.

The data transferred this way (which could be even more entropy - Eve doesn't know which part of the data is which!) would be protected by the initial challenge, and by the entropy of the initial OTP.

Likewise Bob cannot decrypt anything because he does not have access to Alice's entropy source.

Would it be instead preferable to perform an RSA/Diffie-Hellman key exchange over the initial OTP?

Absolutely! Diffie-Hellman is used by every single bank out there for a reason. OTP can be unbreakable if done right, but is so cumbersome that isn't practical and that's why is rarely used in the real world. IfDiffie-Hellman is good enough to banks protect themselves, is good enough for you, Bob, Alice, and for me.