Is this a correct installation of a whole house Surge Protector?
You will need to flush-mount the protector, feeding the wires through a knockout

Since your panel is flush-mounted into the wall, and you generally are best off not modifying a deadfront if you can help it (while the UL listing on the loadcenter cabinet is not technically necessary, modifying the cabinet deadfront could confuse an inspector).  Instead, you'll need to use a HEPD58MKF or HEPD80MKF flush mount kit to mount the surge suppressor into the drywall, along with the short length of flex conduit and supplied fittings to route the wires from the HEPD80 surge suppressor into the panel.

As to making a knockout for the surge suppressor wires to go through, you'll want to make a 7/8" hole in the panel's side (this is the actual size of a knockout hole for a 1/2" nominal conduit fitting) that is directly aligned where the breaker you put in for the surge suppressor is.  The easiest way to do this is with a tool called a knockout punch; a cheap set will do you just fine.  I would not use a drill for this; even with the panel dead, it's very hard to guarantee that stray chips from drilling haven't gotten places that would cause bad news when the power is turned back on.

That 30A breaker, it turns out, is OK after all

The instructions for the HEPD80 allow for the use of a 30A maximum breaker; this isn't an issue since the conductors to the SPD carry practically no current in normal operation, and the device can't generate an overload condition, so short-circuit/ground-fault protection is the only concern here, and UL has tested the device with 30A breaker protection.

Note that while it is possible to tap an existing breaker of suitable size to install a SPD like yours, that has the downside that an overload or short on that circuit will cause a loss of surge protection; as a result, it's recommended to do as you did and use a dedicated breaker for installing the SPD.  (It's also possible to install the HEPD80 tapped directly off the busbar, but that has the downside that you have to kill power to the whole panel to service the surge protector, so having it on a dedicated breaker makes sense.)