Strictly speaking, do Tasks need to run in an environment that has the original "Task" function source code? Cloudpickle/pickle would lead me to think that the "bare minimum" necessary would be just an environment with task's py dependencies, but not the task source code themselves.

To understand all the concepts such as what is Flow, Task or Agent, check our Core Concepts documentation

Well, pickle or not, the Flow gets the task code from Storage. So if it’s pickled, it’s still there, just in a serialized form. If it’s script-based (ex. Github), then it’s just read during runtime. In both cases though it’s read.