Lift the pyrefly <1.3 cap: 1.3.0 reports 5 new type errors

Nobody has claimed this yet.

pyrefly 1.3.0 (released 2026-09-11) reports 5 new errors on an unchanged `main` (fefed57d) under `[tool.pyrefly] preset = "legacy"`. It turned the weekly drift lint leg red on 2026-09-14 ([run](https://github.com/lnccbrown/HSSM/actions/runs/34808842835)). The last green lint run (2026-09-07) used pyrefly 1.2.0. mypy (2.3.1), xarray and arviz were unchanged between the two runs.

HSSM has no lockfile, so every PR's lint job gets 1.3.0 too. The companion PR caps `pyrefly<1.3` to unblock CI. This issue tracks the real migration and lifting that cap.

| Location | Error |
|---|---|
| `src/hssm/distribution_utils/onnx_utils/onnx2xla.py:49` | Class `AttributeType` has no class attribute `items` [missing-attribute] |
| `src/hssm/plotting/utils.py:592` | `not in` is not supported between `Literal['posterior_predictive']` and `None` [not-iterable] (and the same for `'prior_predictive'`) |
| `src/hssm/plotting/utils.py:604` | `None` is not subscriptable [unsupported-operation] |
| `src/hssm/utils.py:188` | Argument `DataArray \| DataTree` is not assignable to parameter `posterior` with type `DataArray` in `log_likelihood` [bad-argument-type] |

The two `plotting/utils.py` errors come from `dt = model.traces` right after an `is None` guard. 1.3.0 no longer narrows the attribute. The `utils.py` error is `dt["posterior"]`, which xarray types as `DataTree | DataArray`. None of these look like runtime bugs, but each one needs someone to decide between a narrowing fix (`assert`, `cast`, a local variable) and a suppression.

**Done when:** `uv run pyrefly check` passes on pyrefly 1.3.x and the `<1.3` cap is removed from `pyproject.toml`.

Refs #1302 (drift queue). Filed by the unattended spine drift-heal session.

Start with src/hssm/distribution_utils/onnx_utils/onnx2xla.py:49, src/hssm/plotting/utils.py:592 and 604, and src/hssm/utils.py:188; inspect the reported pyrefly 1.3.x errors and the surrounding type annotations. Run `uv run pyrefly check` while evaluating the narrowing or suppression approach for each location. Done means the check passes on pyrefly 1.3.x and the `<1.3` cap is removed from pyproject.toml.

Written by the indexing model from the issue text.