So a flow contains its code, its task runner definition, etc., a work pool knows where/how flows get executed (infra), and a deployment is a named binding of a flow to a work pool (many-to-many)?

The first part is correct. A few notes. A deployment has only one work pool associated with it. A flow could be used in multiple deployments, so the flow could be used in multiple work pools. The deployment also contains info about where to fetch the code.