fix: filter candidates if we are _at_ or above the SP's max-concurrent

[rvagg]

Currently it's >, not >=, but when it hits retrieval-proper it does a >= so candidates can make it through this step but fail at retrieval because they are maxxed out. This now matters because we are reporting metrics on the number candidates that get through.