MODE GPIO0 GPIO2 GPIO15
UART Flash 0 0 0
Normal Run 1 1 0
SD Card Boot 0 0 1
Only the first 2 are relevant here. So GPIO15 must be low for both flash and normal run and should be pulled down with <= 4K7. GPIO2 must be high. It has an internal weak pull up which is OK under most circumstances but you can put a 10K pull up. Then GPIO0 is the determining factor between flash and run.
These pins are sensed during the first few 10's of milliseconds. They don't need to be maintained after this.
So to get into flash GPIO0 is pulled low and a reset applied either by switches or an automatic circuit. GPIO0 may be released after a short while and it will remain in flash mode until either a flash is ended and the CPU reset by the end of flashing, or another reset is applied.
It is harmless but not required to keep GPIO0 low during the flash upload, BUT must be released before the flash ends and the CPU is reset or you end up back in flash mode.