1) If you let KindleTool pack stuff itself, it will automatically try to use sane permissions (root:root & 644 or 755 IIRC). If you pack part of your stuff yourself, you'll need to take care of that (hence the dependency on GNU tar in some of my packaging scripts).
2) Note that, in the specific case of an update script, root is already rw at the time the script will run (unless something went very wrong), which is why you don't see a mntroot in any of my update scripts
3) Nope. On the K1/2/3/4, the update process is done in a specific runlevel, with only the most basic stuff running, and on the K5/PW, it's done after stopping a bunch of stuff, and it does a full reboot at the end.