In a POSIX system, there is a value, ARG_MAX, defined in with a minimum acceptable value of _POSIX_ARG_MAX (which is 4096). You can discover the value at run-time via the sysconf() function with the SC_ARG_MAX parameter.
It is often 256 KiB.
The data in argv (both the array of pointers and the strings that they point at) are 'owned' by the program. They can be modified; whether that is sensible depends on your viewpoint. You certainly can't step outside the bounds of what was passed to the main() function without invoking undefined behaviour. Functions such as GNU getopt() do reorganize the arguments when run without the POSIXLY_CORRECT environment variable set in the environment. You already have a pointer to the data in the argv as provided to main().
Empirically, you will often find that the data immediately after the end of the string argv[argc-1] is actually the start of the environment. The main program can be written as int main(int argc, char **argv, char **envp) in some systems (recognized as an extension in the C standard Annex J, §J.5.1), where envp is the same value as is stored in the global variable environ, and is the start of a null-terminated array of pointers to the environment strings.
