You pay for the console, and the games are open by design. You can load any pico game into the console, go into edit mode, and see / edit assets, music, levels. The console only supports lua, which gives you the advantage that every game you open to see the source code will be written in the same language. A wonderful little thing. I used it to introduce kids to game development with good results.

To add to this - each game is stored self contained into a png image file [0], where the assets and code take up predictable sections. Each image is the entire game.

It's pretty easy to build your own tools to generate the format, if you were inclined to build an IDE or something along those lines.

[0] https://pico-8.fandom.com/wiki/P8PNGFileFormat

The data is hidden in the image data itself, it seems(!) Does this mean that an accurate screenshot can be used to clone the cartridge? For fun, of course.

Yes all the data (source, sprites, sound) is encoded in the PNG. You can simply copy the PNG to clone it (screenshot won't work though):

https://www.lexaloffle.com/bbs/cposts/un/undune2-3.p8.png

Also note that there is a "Code" button under the game window which shows the full source code.

Unfortunately, no, I don't think that's possible. There's a few null bytes used here and there, like marking the Lua offset, and your screenshot can't capture those, no matter how accurate the rendering of the actual bytes is.

There is no console, it's a virtual machine that computers can run.

There is a "virtual console" i.e just the virtual machine :) And yes, it's sold for a small sum.