I can answer some questions, and I hope someone else can fill the blanks.
1. Can recovery flash bootloader?
=> Yes, you have to modify your boot image, but it still possible, just include the modified boot image in the update file, and give good command in update.zip
2. Can recovery flash recovery partition itself?
=> I am not sure, but I think its possible, I saw code of recovery in Android code, so if you modify it, and include the good image in update.zip, I think you will see the modification. Never tried for now.
3. We know in update.zip, boot.img is corresponding boot partition, but why system is a folder, not system.img? There is a system partition also.
=> In fact is depend witch compilation system you use. For Cyanogen, yes in fact its a folder, but for AOSP its System.img
The difference comes from the command file in update, theire not the same. But finally the result in the same. We have a system partition.
4. While OTA upgrade system, why the update package downloaded under /cache path? Can we change it to sdcard?
=> Reasons I can see :
--> In past, sdcard was not mounted by default in recovery mode, so can't see the update.zip file
--> sdcard can be removed at any time, its dangerous, when do the update to loose the file
--> To be sure have right to remove the update.zip when installation done
--> Old phone didn't have all a sdcard, cache is sure to exists
=>Yes we can change it, but we have to be sure the sdcard is mounted on recovery mode. And be sure of the path of sdcard on recovery mode. For exemple in Nexus one it is /sdcard, in Samsung Galaxy S2 is /emmc/, in Samsung S4 mini its /sdcard/0/ ... So it could be a reason why its not in sdcard, because the path is not generic.
5. Most important, what exactly update-script do things under recovery mode? How the command executed?
=>It does lot of stufs, like mount partitions, copy system files, ...
The update-script is in elf script. Generally, an elf interpreter is given just next to the update-script.
I hope it helped you,