The board is only Jay, Jack, and Jeremie, no one else. They each have 1/3 voting power.
The $13M funding from Twitter/Jack was more like a grant than investment; they took no equity stake in exchange for it. Bluesky is currently employee owned.
The web and mobile apps aren’t open source yet, but the server(s) and other code are.
The biggest goal and protocol difference vs ActivityPub is true account portability, even if your current server goes offline or malicious. Jay has said this was the primary goal that made them not just use AP. (I’ll try to find this post to cite.) Notably, when you migrate your account, your identity stays the same, unlike AP where it changes from user@domain1 to user@domain2. (Mastodon does add a non-standard human-readable “redirect” and tries to propagate followers, granted, and you can export and re-import your posts, but those are all awkward band-aids at best.)