Static scanners (Aikido) flag the directory-listing→file-read flow as a
file-inclusion risk. Read a fixed THEME_FILES list via constant paths instead
(matching the other unflagged scripts); readdir is now only used to fail if a
new theme .css isn't registered, so coverage still can't lapse.