Hi,
You only need to put the package on the node you are running the upgrade command on.
I cannot vouch for how well it works however, its not a method I use.
You need to make sure that all redundancy groups are on a single node. You may get a failed upgrade if RG0 is on node0 but RG1 is on node for example.
See below the start of an upgrade, notice the "pushing bundle to node0", should answer your question about the package not being needed on both nodes:
user@srx> request system software in-service-upgrade junos-srxsme-10.4R4.5-domestic.tgz reboot
Chassis ISSU Started
Chassis ISSU Started
ISSU: Validating Image
Inititating in-service-upgrade
Inititating in-service-upgrade
Checking compatibility with configuration
Initializing...
Verified manifest signed by PackageProduction_10_1_0
...snipped for brevity...
Validation succeeded
ISSU: Preparing Backup RE
Pushing bundle to node0
...snipped for brevity...
Saving state for rollback ...
Finished upgrading secondary node node0
Rebooting Secondary Node
Shutdown NOW!
[pid 1969]
ISSU: Backup RE Prepare Done
Waiting for node0 to reboot.
node0 booted up.
Waiting for node0 to become secondary
node0 became secondary.
Waiting for node0 to be ready for failover
ISSU: Preparing Daemons
Secondary node0 ready for failover.
Failing over all redundancy-groups to node0
ISSU: Preparing for Switchover
Initiated failover for all the redundancy groups to node1
Waiting for node0 take over all redundancy groups