fix: clamp max-concurrency in custom analysis to avoid deadlock and panic (#1700)