Specifically, if cfengine is used to install the most recent version of an onboard device's firmware and do some tests to see if a reboot is required, and the results indicate that the machine needs a restart, is this something that can be done from within cfengine or should that practice be avoided? If so, why? My experience with Puppet tells me that stopping a run to reboot could be a Very Bad Thing in certain cases, so I'm wondering if the same limitations apply to cfengine as well.
This is a policy question as well as a technical one.
From a technical perspective, the potential problem is that your reboot will interrupt the remaining cfengine run, which might lead to a half-baked and thus corrupt state. However, this is a flawed argument - any reboot, automatic or manual or caused by hardware failure or power interruption, will have this problem, and cfengine actions and other automation should be written to deal with that.
That leaves the policy question: The system is in use for some purpose or other. You don't say whether this is for home automation, plant automation, workstation, server... the purpose decides whether it's OK to do unannounced reboots, discarding all in-flight transactions, all in-memory state, and all active sessions. Nobody besides you and your users, if any, can answer that.