Clean instance interface.

* `execute` seems protected (not in README and bypass validations);
  For subclasses only.
* `execute!` is removed (not in README so probably not part of the
  public API). The bang was confusing here because of `run!` that
  throws an exception while `execute!` didn't. `run` is the natural
  replacement here and correspond to the similar class method.

In other words, we now have the following contract both on the class
and on the instances:

* `run` validates preconditions then executes the command if everything
  is fine. It returns an `Outcome` in all cases.
* `run!` validates preconditions the executes the command but raises a
  `ValidationException` is something goes wrong.
* `execute` is the non-robust (protected) version of `run`. It does not
  check the preconditions and does not exists on the class.