How to create a "local (non-cloud) instance of ServiceNow" on a linux box?
Furthermore, as I am a total beginner, please provide guidance on:
Would testing results be mostly portable to other OS'? Would cli interface be available (e.g. SQL queries or version control level of access to JavaScript source files)?
Although I believe that ServiceNow does offer some sort of on-premise (non-cloud) installation, it is definitely reserved for special customers - those who can demonstrate that their data security needs are above what ServiceNow can offer (which is substantial) and who are willing to pay $$extra$$ for it.
That said, there are several ways to test things outside your in-use/production instance.
Developer instances
These are freely available at developer.servicenow.com (registration required) and have almost all the capabilities of any production instance (a few plugins have to be requested from HI support). If you don't have strict data governance, you could export update sets to a developer instance and run your testing there.
Use a backup service
There are companies such as Perspectium that provide near real-time backup (offsite caching) of your NOW data to a SQL database. You can choose to sync almost any kind of record (including scripts, images, and documents) and this data can be used any way to you want. It doesn't provide a runtime, so "testing" is hard.
"Real User Monitoring" (RUM) or "user mocks"
There are many monitoring packages out there that are good at the basics (can I ping it? does the HTTP interface respond? how much CPU resource is in use?) but few that can replicate the experience of a user clicking buttons. One of my favorites is sitespeed.io because it's OSS (most products are $$$$) and rather easy to use. The product is billed as a "speed testing" utility, but timing data can be easily interpreted to determine feature viability.
ServiceNow's Test Management
Take a look a the Test Management framework. It's based on manual testing (there might be some automation) but gives you a way to define each test so that testers can easily accomplish the validation and report defects.
As far as I know, there is no way to interact with the instance(s) directly (it's a SaaS product). There is a CLI, but it's for developing apps and UI, not configuring the base product or modules. Also, App Studio and UI Builder have interfaces to git, allowing you to do offline, code-only development, but again, there's no runtime, so you can really only run code linters locally.
I have found that there isn't a single approach that works for all testing. Because there are so many parts/modules/features that can be configured, each needs to be tested in a different manner. Sometimes, it's either not possible or not practical to set up a user-mock just to test a Scripted REST API, it's generally not valuable to validate forms with an HTTP request, and sometimes it's ridiculous to require a tester to type in large numbers of parameters or accurately complete 50 steps.