You are expected to return a dynamically allocated string.

You are right that returning internally allocated strings is a poor design choice, it is unfortunately a long established convention for C translations of Codewars challenges, especially the older ones, created by translators who either did not know what are valid patterns, or simply did not care. Fortunately, currently active C translators came up with much saner setups, like preallocated output buffers, mutable buffers, and generally much better and idiomatic setups.

If you see a C translation which requires you to return a pointer and no explanation how it could be allocated, most probably you have to dynamically allocate the buffer. And still this is not the worst kind of a setup: there are some old setups which require you to return a malloced buffer of... pointers to individually malloced ints. And they do not describe this aspect at all, you need to deduce it from errors. Those are fun.