wouldn't it be harmless to do some experimentation on the external pwd?
It's a bad bet that nothing uses /bin/pwd. It's good practice in shell scripts — particularly those commonly run by root — to give full paths to external programs, for security reasons.
Still, you could safely build a custom pwd and put it under in your home directory somewhere. If the package uses Autoconf, this is usually enough to configure a package to be installed under your home directory:
$ ./configure --prefix=$HOME
You might say something like --prefix=$HOME/pwd-test instead, to avoid any possibility of conflict.
As long as the package's build system is set up correctly, when you've configured it like that you can safely say make install without being root, because all files it writes should go under the prefix you gave.
Where is the source for pwd?
pwd is part of coreutils. You find such things out with the Debian package search engine.
Do you usually get it with the distribution (I'm on Debian)
You probably haven't downloaded the distribution sources yet, but yes, it's considered part of the Debian distribution. They're separated out into a six-disk (!) source DVD set, comprising about 25 GB, which is why most people never download them.
Unless you're trying to do something like rebuild the whole Debian distribution or create a derivative distribution, though, you probably shouldn't download them even now. A la carte downloads are probably a better idea at this stage.
do you somehow install or download it?
Yes, you can also use apt-get to install source code for packages. There's a whole chapter in the APT HOWTO on this.
(That document is marked Obsolete, but I'm not seeing a replacement document.)
Is it in C?
In all likelihood, yes.
Do I compile it like any other file with gcc and put the result (with fitting chmod) in a folder encompassed by the path?
You probably don't run gcc directly, you probably do the standard configure ; make ; make install dance. If you download the source tarball from the Debian package search page, you will probably find an INSTALL or README file in the tarball, which will contain build instructions.
What about upgrades?
What about them? The package search engine will help you find any version of the software you're likely to want, and apt-get will help you track changes to the sources just as it will for binaries.
I'm missing the big picture here.
You might want to take a look at the Debian Documentation, then.
the header file seems to be unrelated: pwd as in password, not print/present working directory.)
Yup. It's a utility header for C programmers, for getting access to the user database. Say man 3 getpwent to get some idea of what's available through that interface.