Fix exception handling for internal run_command calls

Many internal uses of run_command were not checking that the
return value was a hash reference before dereferencing it.

This commit implements a new '_try_run_command' variant that throws
exceptions on errors.  Where appropriate, internal run_command calls
were switched to _try_run_command with use of Try::Tiny as needed.

Methods that directly returned the result of run_command to
end users were left alone to avoid breaking the public API.