I didn't realize that I could pull the bootloader out of the firmware.zip.
Recovery and bootloader are two completely different things! You can pull
recovery.img from firmware.zip, and flash with fastboot. I would not do this with bootloader, which would require s-off (to flash manually) and it would still be risky. Better to flash the whole firmware.zip or RUU, if you want to update bootloader. But I don't think that is what you meant.
I had to un-root and install Android GPE. It's not really AT&T anymore. Now I can download OTA updates, but cannot install them because TWRP is still the bootloader. I would rather do the OTA updates since the phone is already stock-ish and resetting everything is only slightly preferable to stabbing my eye out.
Since I'm unlocked on marshmallow, it looks like I want the 6.12.1540.4 zip.
Your description is confusing, and I think you're mixing the terms up again. 6.12.1540.4 is the version number for the
US Developer's Edition, which is Sense, and not the same as
Google Play Edition (GPE) which is not Sense.
To OTA, the version number of the current stock ROM needs to match your firmware number (in bootloader and getar all), and you also need matching stock recovery.
To be clear, what is the current ROM (and version number) as shown in Settings? And also do fastboot getvar all, and post the result (delete IMEI and serial number). Need those pieces of info, before I can properly advise what stock recovery to use.