1. Right, glue it inside would work. Cardstock is paper, so no worries about testing. You can ask about testing of the dye on the feathers, but joann's doesn't have to test. Modern dye methods don't contain lead, and your hat is not a toy, and is used for photo shoots or a short period of time while picture taking at a party. I"d not really worry about it. Try taking a sample of the feathers and wet them, does the dye come off when you rub it? If not it's not going to come off if the baby sticks it into it's mouth. I'd be more worried about the dye in the frosting.
2. I keep my receipts, and when I get home I go thru my purchases and write on the receipt what it was (red baby wale cord, lavender mini floral, black buttons for marley dress, etc) I also make a copy of my listing and attach snips of fabric, how much it cost to make, button cards, etc, thread color numbers, and any notes . This goes into a clear 3 hole punched page sleeve and into a notebook. When I sell the item, I make note of who, what , when and how much,. I can make a certificate of conformity at anytime with the information on that paper, if I should need too,
5. You really need a certificate of conformity from them, How are they able to state thery are compliant if they don't know?