Summary

Finding 0002 (missing HSTS header, incomplete CSP) was already fixed in commit 332547a (#98, "fix(security): emit HSTS conditionally and harden CSP"), but its finding doc was never cleaned up per the doc-sync convention.

Verified PR #98's diff covers everything the finding doc asked for:

• HSTS: securityHeaders now emits Strict-Transport-Security: max-age=31536000; includeSubDomains, gated on the existing CookieSecure config flag (option 2 from the finding's fix instructions — avoids a spoofable X-Forwarded-Proto check).
• CSP hardening: base-uri 'self'; object-src 'none' added to the policy string.
• Test coverage: internal/app/security_test.go added, covering CSP directives and both HSTS on/off states.
• docs/SECURITY.md: "Product Security Features" already documents the header baseline including conditional HSTS.
• CHANGELOG: already has a one-line entry under [Unreleased] / Fixed referencing docs/agent/findings/0002.

Only the finding-doc/tracker cleanup was missed — this PR does just that.

Scope

• docs/agent/findings/0002-missing-hsts-csp-hardening.md (removed)
• docs/agent/findings/README.md (open-findings table now empty)

Non-goals

• No code or CHANGELOG change — both were already correct on main.

Validation

Docs-only.

• go build ./... && go vet ./...
• go test ./...
• gofmt -l internal cmd is clean

Security / scanner boundary checklist

• The web app remains unprivileged.
• No raw sockets, nmap, packet capture, or network capability were added to the app.
• Scanner-agent privilege boundaries are unchanged or explicitly justified.
• App-side and agent-side scan allowlist checks remain intact where relevant.
• Strict CSP preserved — no inline JS/CSS; generated CSS came from the Tailwind source.
• No unrelated refactors or dependency additions.