cpupick: Make tun.avoid_cpus a pin selection rule instead of a process-wide mask

examples/config.yml

@@ -295,12 +295,13 @@ tun:
   #  - 2
   #  - 4
 
-  # Linux only. avoid_cpus removes these CPU IDs from the affinity of every thread of the process at startup,
-  # embedding applications included; later threads inherit the remaining set. Applied before cpu_affinity and the
-  # default pin selection, independent of pin_threads. Invalid IDs, or IDs that would leave no CPU, fail
-  # startup. Not reloadable; ignored on other platforms. To keep Nebula off the underlay NIC's receive IRQ CPUs, find
-  # them in /proc/interrupts and /proc/irq/<IRQ>/effective_affinity_list, add their SMT siblings from
-  # /sys/devices/system/cpu/cpu<N>/topology/thread_siblings_list, and revisit the list when IRQ placement changes.
+  # Linux only. avoid_cpus lists CPU IDs the tun readers are never pinned to, exactly as listed (SMT siblings are not
+  # added for you). The default pin selection skips them, even with a single routine, and a cpu_affinity entry naming
+  # one is rejected like any other invalid entry. Other threads are not restricted, and the setting does nothing with
+  # pin_threads: false. Invalid IDs, or IDs covering every allowed CPU, fail startup. Not reloadable. To keep Nebula
+  # off the underlay NIC's receive IRQ CPUs, find them in /proc/interrupts and /proc/irq/<IRQ>/effective_affinity_list,
+  # add their SMT siblings from /sys/devices/system/cpu/cpu<N>/topology/thread_siblings_list if you want those kept
+  # clear too, and revisit the list when IRQ placement changes.
   #avoid_cpus: []
 
   # Route based MTU overrides, you have known vpn ip paths that can support larger MTUs you can increase/decrease them here