Where is this function’s callback getting its arguments from?

If you have a look at function do_meta_boxes() in wp-admin/includes/template.php then you’ll see this line close to the end of the function:

call_user_func($box['callback'], $object, $box);

That calls the callback function and provides the two arguments. The $box argument holds all the information about the metabox, like ID, title, callback function.

In wp-admin/edit-form-advanced.php, which displays your post edit/create screen, you can see the do_meta_boxes calls in action, e.g.:

do_meta_boxes(null, 'advanced', $post);

So, in that case $objectwould indeed be a post object. In other cases, like the dashboard screen, $object is actually set to an empty string.

It might be worth noting that add_meta_box() just adds to the $wp_meta_boxes global. In do_meta_boxes() that global then gets looped through and the boxes are being displayed.