Make nanoeval global concurrency check atomic

[sylvesterkaczmarek]

Summary

• move the global running-task count and concurrency-limit check inside the same exclusive SQLite transaction used to claim a task
• roll back the transaction when the global limit is reached or cannot be read
• add regression coverage asserting that the concurrency check begins only after BEGIN EXCLUSIVE

_maybe_pull_task_from_queue() currently checks num_running < max_concurrency before starting its exclusive transaction. With multiple workers, two workers can therefore observe the same available global slot, then serialize through the transaction and each claim a task. The resulting number of running tasks can exceed the configured global concurrency limit.

This change starts BEGIN EXCLUSIVE before reading the running-task count and keeps the limit check and task claim in one transaction. That makes the check-and-claim operation atomic across workers while preserving the existing per-eval concurrency query and task-selection behavior.