The image provided by the client when using the HTTP push URI can internally contain many software packages. The format of the image is not dictated by Redfish.
The "target" property in an action is not a parameter provided by the client; "target" is the way the service tells the client the URI that is used to invoke the action. The "StartUpdate" action is not used to provide an image or specify what devices are updated. "StartUpdate" is used in conjunction with either "SimpleUpdate" or a push update request where the client requested the update to be deferred until the "StartUpdate" action is invoked (using "@redfish.OperationApplyTime" with the value "OnStartUpdateRequest"). It's expected that when the client goes this path that they provide all of the necessary parameters for the update when invoking "SimpleUpdate" or the push update (along with "@redfish.OperationApplyTime" with the value "OnStartUpdateRequest"), and when the client is ready to begin the requested update, they invoke "StartUpdate".
For question 1, yes, you can perform multiple updates in a single request. OEM actions are not needed.
For question 2, there are no updates planned. It seems like everything is covered today.