Yes, I will accept the “newbie” embarrassment and answer my basic questions . 😉
1.) www-data
2.) For fellow wp-cli newbies, follow this excellent tutorial to get wp-cli working in local dev, and remember NOT to forget the last step. 🙂
3.) One should never put the html directory in /home/ for the reason malicious actors could use www-data/php to go beyond the html directory to explore the contents of the user’s home directory. However, www-data to having access to .wp-cli located in the home directory, still not clear of the security risk level, seems debatable.