Why doesn't this dummy mutual authentication protocol provide mutual authentication?
I think you've got all the right ideas but I think you're lacking an understanding about how Public Key Cryptography works.

Trudy can only impersonate Alice in this scenario with a replay attack (or if some kind of authentication credentials are returned...like an http cookie, Trudy could steal that too). Since she does not have Alice's private key, she can only successfully respond to Bob's challenge by waiting for Alice to respond and stealing response. In this simple scenario, Bob will be unable to tell if Trudy sent the message or if Alice did.  

In reality, Bob and Alice have everything needed to create a secure protocol. Because Bob and Alice have the capability to verify the message was sent (using eachother's public keys), they can also encrypt messages only the other can decrypt. Bob can sign his challenge he has generated, encrypt this using Alice's public key, and then send it all to Alice.

Alice then decrypts, verifies Bob sent it using his public key, and can generate the response, sign it, and encrypt the same way Bob did.