prog-amateur Can an application installed in the private space that (unreasonably) requests access to the call log, contacts, or files (photos, among other things) retrieve its data from the main space when the private space is unlocked?
All files access (including photos) are per profile, so apps in the hidden space, even if you grant full files access, can only see, access and modify files that are stored in the hidden space, not the main profile at all. GrapheneOS also implements a Storage Scope feature where you can grant full files access to an app, without actually granting it any files access at all or only select files you want, so you will never actually need to grant these permissions to any app ever. Actually, never do that. If the app don't work if you click deny, choose to setup Storage Scope instead.
I don't know how call logs and contacts work. But for contacts GrapheneOS implements a Contact Scopes feature that grants full access to all contacts, without actually granting access to any contacts other than the ones you want to (which can be zero). So again, you never ever need to grant contact permission to an app. If the app does not work if you click deny, select to setup Contact Scopes instead. Never actually grant contact permission.
prog-amateur The same applies to applications that use known trackers such as Google Firebase Analytics, Google CrashLytics, etc.: can they track activity in the main space once the private space is unlocked?
GrapheneOS does not implement any tracking. If there is a tracker, it is implemented in a specific third-party app you have installed yourself. The tracker will only be able to track activity in that single app, not other apps (unless those other apps specifically allow it), since the tracker will be sandboxed to the same level as the app itself.