Do not leave your html_includes files at 755! See here.
ZenCart does not have the power to stop you from using a randomizer on your images. No CMS does. That was not what was going on.
I was getting the link:
http://www.fairytalemail.co.uk/includes/templates/santa/css/templates/santa/images/header/rotate.php
from HTML source code of your site. That was literally where the src of the image was pointed.
The 403 error when trying to access this file:
http://www.fairytalemail.co.uk/includes/templates/santa/images/header/image.php
via HTTP is correct. No remote user should be able to execute PHP scripts from within the includes directory. If that worked it would pose a serious security risk.
This is not a permissions issue - this is an execution issue. You were trying to have the src of your image point to a PHP file which would then respond with an image (NOT an image URL). While this is possible in certain scenarios, this is a bad idea when working with CMSs.
I suspect (but am not 100% certain) that the problem you were having with the randomizer PHP code in define_main_page.php is that it never got to the server. If your permissions were set to 444 or perhaps 644, depending on how you were trying to put the file on the server, the server was rejecting the file and it was remaining unchanged. Changing the permissions to 755 allowed you to over-write the file with your changes and that is what allowed it to work.
Be sure to change the permissions back to 644! In fact, I'd highly and strongly recommend going through all of the security recommendations on the page linked to above ASAP.
BrandTim