fix: address review feedback — reduce concurrency limit, fix copyright

- Change default concurrency from max(NumCPU*2, 10) to max(NumCPU, 5)
  to avoid contention on remote state optimistic locking and limit
  pressure on AI-enabled policies (per migmartri and jiparis feedback)
- Fix copyright year in concurrency_test.go

Signed-off-by: Vibhav Bobade <vibhav.bobde@gmail.com>

Author: waveywaves

pkg/policies/concurrency_test.go

@@ -1,5 +1,5 @@
 //
-// Copyright 2024-2026 The Chainloop Authors.
+// Copyright 2026 The Chainloop Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.

pkg/policies/policies.go

@@ -75,9 +75,9 @@ const (
 )
 
 // defaultMaxConcurrency is the default number of concurrent policy evaluations.
-// Set higher than NumCPU because policy evaluation is I/O-mixed (gRPC calls,
-// file loads) rather than purely CPU-bound. Can be overridden via WithMaxConcurrency.
-var defaultMaxConcurrency = max(runtime.NumCPU()*2, 10)
+// Kept conservative to avoid contention on remote state optimistic locking
+// and to limit pressure on AI-enabled policies. Can be overridden via WithMaxConcurrency.
+var defaultMaxConcurrency = max(runtime.NumCPU(), 5)
 
 type PolicyVerifier struct {
 	policies         *v1.Policies