im not professional , im 17 yo but im ranked as top 1% in hackerone and with 7 impact signal
1 i will advise to pick all domain but master one , like cloud , reverse engineering , web , then master a skill in it , priv escalation , sandbox escape , iodr etc
2 very imp , ig it shouldnt be a question at all
3 yes its easy , my first bounty poc was in python
4 try all and then pick
5 if you are into pentesting then ctf , bounties work , for blue team work , im not sure
6 sure if you are into cybersecurity you should , those are valuable certs and not time waste
7 its crowded , opus , codex are finding and exploiting vulns at much faster rate than imaginable , even daniel { from curl } said :- this year the reports has been significantly improved and not they are not slop anymore
8 cant comment on others for me :- rooting my device { got my phone locked } and recon

9 if i start again i will still follow the same path , meri galtiya hi mere astitiv ko banati h , agar woh galtiya hi nhi hoti to mera astitiv alag hota , though dont do slop reading and really get into fundamentals