I'm not a developer, but can answer some of your questions (at least as they relate specifically to the Nexus 7).
Custom ROMS typically just include the firmware/kernel (and i believe the radio/baseband if it's for a 3g/mobile device, though these can also be flashed separately, and i could be wrong on this part.) Bootloader is typically untouched, but this might differ on other devices.
As for OTA updates and what all they include, well that depends on the device, manufacturer, carrier, and even the specific OTA. It could potentially include everything (firmware/kernel updates, bootloader, radio/baseband, etc.), but may be any combination of the different components.
Available free space on the system partition doesn't really matter if you're flashing a new ROM, because you'll be wiping the partition as part of the flashing process. ROMs typically don't include GAPPS either (unless it's just a modified version of stock), so will actually take up much less room than the stock ROM on their own. Then you can decide which GAPPS to flash separately, there are various packages available in different sizes; some just include the basic google play services needed to have the play store and related basic functionality, others will mirror the stock pre-installed apps.
If you're using a custom recovery to flash a ROM, they typically contain a script to first verify the device matches, if not, it won't even flash. If you do manage to flash an incompatible ROM (via fastboot maybe, or if it doesn't include a verification script), with a Nexus this typically is not a big deal, you just won't ever actually boot into the ROM, but should still be able to boot into recovery or bootloader and then flash a compatible ROM.
If you flash an incompatible kernel on top of a ROM, you'll likely get a bootloop/softbricked device.
Flashing an incompatible bootloader may brick the device. Any tinkering with the bootloader is always risky.
Hope that helps a little, I'll take another look when I'm not at work