docs(CHANGES) Subprocess timeout and ref-heavy remote handling

why: Surface the two user-visible improvements landing in the
fix-sync-hang branch -- a new opt-in subprocess timeout across the
public Cmd APIs, and the resolution to vcspull sync hangs against
ref-heavy remotes -- so they appear in 0.40.x release notes.
what:
- Add a What's new sub-section announcing timeout= on Git.run(),
  Hg.run(), Svn.run(), and the legacy run().
- Add a Bug fixes sub-section covering the ref-heavy remote hang.
- Both entries written to the at-a-glance bar: lead with what the
  user gains or no longer suffers, leave implementation depth for
  the linked PR.

Author: tony

CHANGES

@@ -42,6 +42,21 @@ the private `_ENV` type that was leaking into public signatures:
 `CreateRepoPytestFixtureFn` is renamed to `CreateRepoFn`. Update any
 `TYPE_CHECKING` imports accordingly.
 
+#### New `timeout=` keyword on subprocess runners
+
+`libvcs._internal.run.run()`, `Git.run()`, `Hg.run()`, and `Svn.run()`
+now accept `timeout`, with improved cleanup and handling of stuck
+subprocesses when the deadline fires. (#524)
+
+### Bug fixes
+
+#### Improve handling of ref-heavy remotes
+
+Large repositories (e.g. `openai/codex` at 2,400+ refs) no longer
+appear to hang during `vcspull sync` -- libvcs avoids the expensive
+ref-walking git command that was load-bearing for the URL lookup.
+(#524)
+
 ### Documentation
 
 - pytest plugin: `CreateRepoFn` and `CreateRepoPostInitFn` now render