Static scanners (Aikido) flag the directory-listing→file-read flow as a file-inclusion risk. Read a fixed THEME_FILES list via constant paths instead (matching the other unflagged scripts); readdir is now only used to fail if a new theme .css isn't registered, so coverage still can't lapse.