runCommand() ran any artisan string sent from the browser with no checks,
and the component was mounted on every panel page, so any logged-in user
could run tinker. Every entry point now 404s outside local, and only
named actions from an allow-list can run.