1. If we build a nightly every night regardless of what changed in the repo, the githash may not change (as no new changes in the preceeding 24h period). However the current automation should not build new images if there are no changes in the previous 24h period, so the hash for nightlies should always change. It's not something you can 100% count upon though.
2. No because we cannot predict the size of decompressed KERNEL/SYSTEM files in advance. After decompressing the MD5 hashes extracted from the image are compared against the files on-disk, so if tar expansion fails (lack of space or any other reason) or the hashes are absent; validation falis and the update attempt fails, deleting the content of /storage/.update and rebooting.