P2: `secure` finding-fix recommends `opena2a protect` but `opena2a` may not be on PATH

[thebenignhacker]

Pre-existing, surfaced during 0.23.4 release-test (PR #198)

Several findings in `hackmyagent secure` include fix-text that cites `opena2a protect .` (or similar). For a user who installed `hackmyagent` standalone (not via `opena2a-cli`), `opena2a` is not on PATH.

Phase 4f (concept-explainer + finding-fix cross-reference) violation: cited commands shipped to users that don't exist in the user's environment.

Reproduction

mkdir -p /tmp/hma-test-XXXX && cd /tmp/hma-test-XXXX
npm init -y
npm install hackmyagent
cat > .env <<EOF2
OPENAI_API_KEY=sk-fake1234567890abcdef
EOF2
./node_modules/.bin/hackmyagent secure . --ci

Look at the `Fix:` line on the `Password embedded in URL` / hardcoded-secret findings — cites `opena2a protect .`. Run that — it fails: `command not found`.

Suggested fix

Either:

1. Replace `opena2a protect .` references with an HMA-native equivalent (`hackmyagent secure --fix .` already exists).
2. Add an inline install hint: `Install opena2a-cli first: `npm install -g opena2a-cli`, then run `opena2a protect .`.`

(1) is cleaner because it doesn't introduce a hard dependency on a sibling CLI. (2) is needed if `protect` does something `secure --fix` doesn't.