udp: Add opt-in ordered staged receive processing

examples/config.yml

@@ -271,6 +271,14 @@ tun:
   # the use_offloads setting controls if Nebula will attempt to enable GSO and GRO for the tun device. Linux only, not reloadable.
   #use_offloads: false
 
+  # Linux only. staged.workers enables staged receive: each routine hands its received batches to this many decrypt
+  # workers, then an ordered writer commits them in arrival order through the same replay, roaming and firewall
+  # handling as inline receive. 0, the default, keeps receive inline. Batches below 256 packets on an idle listener
+  # stay on the listener. Needs no support from peers. Costs about 24 MiB of buffers per routine at listen.batch 64
+  # with GRO. Not reloadable.
+  #staged:
+  #  workers: 0
+
   # Linux only. pin_threads pins each tun reader/encrypt OS thread to a single CPU. This keeps every goroutine's
   # batched sends flowing through one XPS-selected NIC TX ring, so packets within a flow stay ordered on the wire
   # instead of being sprayed across multiple TX rings and reordered. Not reloadable. Coerced to false if routines <= 1.