[Fire HD 8 and HD 10 Original Android Development] chairmanmiaow:
I feel your pain chief as a veteran XDA user - it's the best source of information for this sort of task by far but it's usually borderline impossible to find exact, detailed and current instructions that are 100% applicable to a given use case. Instructions get old, newer software versions invalidate prior techniques, factually incorrect or dangerous information is rarely corrected or removed, etc. When a bunch of mismatched and contradictory instructions are all that stand between your gadget and a total brick I don't blame you for wanting some 100% confirmed working steps before committing. Apologies but I can't give you that either - as I said, I stupidly didn't bother taking notes when I did it a few months back so am going on memory and my shell history ¯\_(ツ)_/¯

Speaking of which, checking my shell history I find this several times:

adb sideload ~/Downloads/update-kindle-40.6.5.4_user_654620620.bin

So apparently I didn't need to bother renaming the downloaded Amazon stock firmware to *.zip after all and just sideloaded the *.bin as is.

When I follow your link I am offered the FireOS 5.6.7.0 firmware (specifically update-kindle-40.6.5.7_user_657612520.bin). Either way, take the latest stock firmware you can get your hands on and restore that. Trying to jump back multiple versions when you've had a more recent firmware installed is about the only thing that is guaranteed to kill this tablet (exact details are complex and not worth bothering to try and pick through - just don't do it). As stated before, on this model using Matrix and then this thread's techniques in a chain can root any stock version so far so you don't care about trying to flash older variants. Categorically do not download random crappy old firmwares from random XDA posts, get the latest from Amazon no matter what - at least until someone else confirms that a more recent variant doesn't work. Let other people ruin their devices first, and then learn from their mistakes.

I think that answers all of questions 1 + 2: the answers to questions 3-5 are all basically "yes". However, you don't need to flash Magisk immediately - you can flash it later from TWRP at any point you want. You also don't care about leaving TWRP intact to go back to lineageos as it's unnecessary: you optionally can and in your case you specifically do want to keep TWRP recovery but it's not essential in any way long term. Even if completely reverting to stock or getting a brand new unmodified Suez it can still be exploited remember. The answer to Q5 is more complex as well - there are countless threads and methods for debloating stock but if you're really confident/competent, yes, root access is all you need and you can do it manually with pm commands. Others might scoff but the Amazon Fire Toolbox utility should probably be your first port of call after getting TWRP + stock + root working cleanly - with a couple of clicks it can do the majority of the post-install cleanup for you, and reversibly as well. I believe I used it to automate the disabling of the majority of the Amazon crap, install Google Playstore easily and some cosmetic stuff - I then tidied up bits manually by freezing/unfreezing things, re-enabling unexpectedly non-functional stuff like the Kindle app, etc. Best pointer I can give you is to sort the replacement launcher out without getting caught up with parental control issues or weird lags in starting it up is to install the new launcher and an alternative keyboard (important!) before disabling the Amazon launcher and keyboard. Promote your replacement launcher to a system app and then it'll work perfectly.

In practice I ended up spending much longer fiddling with post-install debloat and tuning than the actual exploit/flashing bit (the actual fun part). There's a lot of trial and error involved to get it "just right", so good luck.