fix: make pyrefly pre-commit work in .codex worktrees (#3126)

## Summary
Pyrefly pre-commit checks were false-failing when this repo is checked
out in hidden-path worktrees (for example: `.codex/worktrees/...`).

## Root Cause
The pre-commit wrapper pinned `pyrefly@0.40.0`, which always applies a
built-in hidden-directory exclude (`**/.[!/.]*/**/*`). That causes
project includes under `.codex/...` to be treated as excluded.

## Changes
- Bump pre-commit pyrefly pin from `0.40.0` to `0.42.0` in
`infra/pre-commit.py`.
- Enable `disable-project-excludes-heuristics = true` in
`[tool.pyrefly]`.
- Preserve key excludes explicitly in `project-excludes`
(`node_modules`, `__pycache__`, `venv`).
- Refresh `.pyrefly-baseline.json` under the updated pyrefly version.

## Validation
- `uv run ./infra/pre-commit.py lib/marin/src/marin/__init__.py` -> OK
- `uv run ./infra/pre-commit.py --all-files` -> OK

This removes the need for `--no-verify` commits caused by this
worktree-specific false fail.

Author: dlwh