Looking it up, I think the more accurate term is actually "partner repacks." [1] They're versions of Firefox shipped with different default settings and/or an extension included by default at install time, IIUC. Though reading this rather opaque page [2] it doesn't seem to explicitly preclude patches to the compiled code, though it seems like they would forbid that.

The key config file is distribution.ini. [3]

[1] https://hg.mozilla.org/build/partner-repacks/file

[2] https://www.mozilla.org/en-US/about/partnerships/distributio...

[3] https://brashear.me/blog/2017/12/07/how-to-deploy-firefox-wi...

I haven't looked into it in a while, but last I knew you had to have MoFo sign-off on a bunch of stuff, including code changes (i.e., you're only allowed to use the Firefox branding if you get MoFo sign-off on those changes; you can always redistribute it without the trademarks).

That's correct. At least it was the last time I chatted with the Mozilla folks about it and from a quick read of their current trademark policy.