Answer to Question 1
The lack of a flame causes a high resistance in the cad cell which drops nearly all the voltage in its circuit, so the safety relay's contacts close and the safety heater starts producing heat. The safety heater acts upon the safety switch contacts which are opened by the expansion of a bimetallic element and the burner motor shuts down.
Answer to Question 2
For heat pumps the first stage brings on the heat pump and the next stage brings on the electric strips as needed.