Can you spell it out further from that document? There's only one mention of zero-knowledge proofs in there, mentioning it as one thing that could be used in verification. The rest of the document is similarly simultaneously dense and vague, so it's really not obvious to me that the actual implementation will be cryptographically privacy-preserving.

I couldn’t find anything in that document or the blog that answers the most basic question - is it going to be an app?

It literally contradicts itself at one point:

“It will also be stored directly on your own device - just like contactless payment cards or the NHS App today.”

An app has totally different capabilities from a card in a wallet.