Pebble engineer here

> Does the health app upload to cloud services? If so, can it be turned off?

It does by default, but you can disable it. I'm actually working on making those options more user friendly :).

> Is the Bluetooth synchronization protocol documented to support open-source app implementations?

Not officially, but we've published open source implementations of at least part of the protocol (see libpebble). Several unofficial implementations followed (e.g. a Blackberry app, among others).