feat: KEEP-541 surface transactionHashes in run status

[suisuss]

Summary

• Add transactionHashes to RunStatusResponse (mirror of the top-level field backend KEEP-470 surfaces from /api/workflows/executions/{id}/status).
• New TransactionHashEntry Go type — required hash/nodeId/nodeName, optional chainId/network/iterationIndex as pointer fields with omitempty so the wire shape round-trips faithfully.
• Render a Transactions section after the summary in non-JSON output. Suppressed when the array is empty and in JSON mode (the field is already present in the JSON payload). Wired into both the one-shot path and the watch terminal-state path (between summary and the stderr error line).

Per-row format, two-space gaps:

Transactions (3):
  <hash>  <nodeName>           sepolia
  <hash>  <nodeName>           1
  <hash>  <nodeName>[#0]       sepolia

• Hash first → predictable column 0 for grep/copy.
• Node label with [#N] only when iterationIndex is set (zero-indexed, raw from the API).
• Chain column: prefer network, fall back to bare chainId as a string, omit the column entirely when both are absent.

Watch one-liner unchanged.

Test plan

• go test -race ./... clean across the repo
• go vet ./... clean
• gofmt -l clean
• Unit coverage in cmd/run/status_test.go:
  • empty array suppresses the section
  • network preferred when both network and chainId are set
  • chainId-only renders as a bare number
  • neither set omits the chain column
  • iterationIndex renders as [#0], [#1]
  • --json mode includes transactionHashes in the payload and suppresses the human section
  • watch + error status prints transactions on stdout before the stderr error line
• Manual smoke against staging: kh r st <id> on a workflow with broadcast txs (single-shot, watch, --json).