Define1 Blum-Blum-Shub generator's output as $b_i=x_i\bmod 2$ with $x_{i+1}={x_i}^2\bmod n$ for $i\ge0$, $n=p\,q$ with $p$ and $q$ distinct odd primes. Unless otherwise stated we do not assume $p\bmod4=3$ and $q\bmod4=3$, even though that's required in the article defining BBS.
BBS is not very practical, but has two theoretical interests: it's security is provably reducible to hardness of factorization of $n$; and although it's defined as an iterated function, knowledge of the factorization of $n$ allows to compute $b_i$ at cost $\mathcal O(\log(i))$.
By induction (and as stated in the question), it holds $x_i={x_0}^{(2^i)}\bmod n$.
I cannot understand how Carmichael's function is relevant.
By definition of the Carmichael function, $\lambda(n)$ is the smallest integer $\lambda>1$ such that for all $x$ coprime with $n$ (as most $x_i$ are) it holds $x^\lambda\bmod n=1$.
Note: It can be shown that when $n=pq$ with $p$ and $q$ distinct primes$$\lambda(n)=\operatorname{lcm}(p-1,q-1)=(p-1)(q-1)/\gcd(p-1,q-1)$$
We can write $2^i$ as $(2^i\bmod\lambda(n))+a\,\lambda(n)$ for some integer $a$. Applying the definition of $\lambda(n)$ it follows ${x_0}^{(2^i)}\bmod n={x_0}^{\left(2^i\bmod\lambda\left(n\right)\right)}\bmod n$. Therefore a (ultimate) period for $2^j\bmod\lambda(n)$ is one for the $x_i$ and the $b_i$.
By applying again the definition of the Carmichael function, this time for argument $\lambda(n)$ instead of $n$, we get that $2^j\bmod\lambda(n)$ is ultimately periodic with a period $\lambda(\lambda(n))$.
It follows that the BBS generator is ultimately periodic with a period $\lambda(\lambda(n))$. We proved this for $\gcd(x_0,n)=1$, but it holds for any $x_0$.
Note: in order to compute $\lambda(\lambda(n))$, we need to factor $p-1$ and $q-1$ (perhaps with the help of a factorization of $\gcd(p-1,q-1)$ in some rare pathological cases). Then we apply that if the factorization of $\lambda(n)=(p-1)(q-1)/\gcd(p-1,q-1)$ is $\prod{r_j}^{m_j}$, then $\lambda(\lambda(n))=\prod{r_j}^{\left(m_j-1\right)}(r_j-1)$.
a formula for the period of Blum-Blum-Shub
The above gives a way to find a (ultimate2) period of BBS if we can compute $\lambda(\lambda(n))$. But that's not necessarily the least period.
By the Chinese Remainder Theorem, $x_i$ can be uniquely determined by $p_i=x_i\bmod p$ and $q_i=x_i\bmod q$. We can thus study the periods and cycles of $p_i$ and $q_i$ separately, then combine to obtain these for $x_i$.
If $(x_0+1)\bmod p<3$, then for $i\ge1$ the $p_i$ are stationary. We'd want to avoid such $x_0$ explicitly for small parameters. When in such edge case, we set $k=1$, $v=1$, and skip the next 4 paragraphs.
By Fermat's Little Theorem, it holds $p_i={p_0}^{\left(2^i\bmod\left(p-1\right)\right)}\bmod p$.
We want to determine the least period $\ell$ of the exponent $e_i=2^i\bmod\left(p-1\right)$. Towards this, we write $p-1$ as $u\,2^v$ with odd $u$, and can again apply the CRT since $u$ and $2^v$ are coprime. The series $e_i\bmod u$ is cyclic starting at $i=0$, with a period $\lambda(u)$ (not necessarilly the least period). And the series $e_i\bmod(2^v)$ is stuck at $0$ starting at $i\ge v$. It follows that $e_i$ enters a cycle exactly at $i=v$, and then is periodic with a least period divisor of $\lambda(u)=\lambda(p-1)$.
We provisionally set $t=\lambda(p-1)$, and find it's factorization (towards this, we need to factor $p-1$ to compute $\lambda(p-1)$, and need to perform further factorization of $p'-1$ for the $p'$ that are odd divisors of $p-1$). Then for each odd prime $r_j$ in that factorization, and while $r_j$ divides $t$, we test if $2^{\left(t/r_i\right)}\bmod u=1$, and if so replace $t$ by $t/r_j$. We end up with $t$ the least period of the $e_i$ (that is also the order of $2$ in the multiplicative group modulo $u$).
We now need to account for the particular $x_0$. We compute $p_v={x_0}^{\left(2^v\right)}\bmod p$ (we are sure that the $p_i$ have already entered a cycle at this point $i=v$, because the $e_i$ have entered a cycle exactly at this point per the above analysis). We provisionally set $k=t$. Then for each odd prime $r_j$ as above, and while $r_j$ divides $k$, we test if ${p_v}^{\left(2^{k/r_j}\bmod\left(p-1\right)\right)}=p_v$, and if so replace $k$ by $k/r_j$. We end up with $k$ the least period of the $p_i$, and assurance that this cycle is already reached when $i\ge v$.
Having done the above for $p$, then similarly $q$, we know that the least period $\ell$ of the $x_i$ is the Least Common Multiple of the least period $k$ of the $p_i$ and that for the $q_i$; and $x_i$ is necessarily in a cycle for $i\ge w$, where $w$ is the largest of the numbers of steps $v$ to necessarily enter a cycle for the $p_i$ and that for the $q_i$.
From $b_i=x_i\bmod 2$ it follows that the least period of the $b_i$ divides $\ell$; and $b_i$ is necessarily in a cycle for $i\ge w$.
These least periods are not always equal: for $n=11\times19=209$, $x_0=7$, the $x_i$ are 7, 49, 102, 163, 26, 49, 102, 163, 26… with least period $\ell=4$; and the $b_i$ are 1, 1, 0, 1, 0, 1, 0, 1, 0… with least period $2$. Both periods are much shorter than $\lambda(\lambda(n))=12$. However (without proof, and with need for cross-checking!) for large $n$ it becomes the rule that the least periods of the $b_i$ and of the $x_i$ are equal, with vanishingly few exceptions (if any past some threshold).
Thus, having found the least period $\ell$ of $x_i$, the factorization of $\ell$, and at which step $w$ the cycle is necessarily entered, we use this information to verify the likely hypothesis that the least period of the $b_i$ also is $\ell$. We do this by finding, for each prime $s_j$ dividing $\ell$, one $i\ge w$ with $b_i\ne b_{\ell/s_j+i}$, thus proving that $\ell/s_j$ is not a (ultimate) period.
Towards this, for large $n$, we need to compute some $b_i$ for $i$ so large that stepping the generator that far is impossible. But we can instead compute $p_i={p_0}^{\left(2^i\bmod\left(p-1\right)\right)}\bmod p$, same for $q_i$, then $x_i=\left(q^{-1}\left(p_i-q_i\right)\bmod p\right)q+q_i$, then $b_i$.
importance of $\gcd(p−1,q−1)$ being a small number
This maximizes $\lambda(n)$ for a given magnitude of $n$. Indirectly, this tends to increase $\lambda(\lambda(n))$. This, and the recommendation that $p\bmod4=3$ and $q\bmod4=3$ made in the original BBS generator (which maximize the largest odd integer dividing $p-1$ and $q-1$), are heuristics towards what really matters to a large least period per the analysis made above: maximizing the Least Common Multiple of the order of $2$ modulo the largest odd integer dividing $p-1$, and the corresponding quantity for $q$.
Towards large least period, we want to pick $p$ prime such that $(p-1)/2$ is also prime and $2$ is a primitive root modulo $(p-1)/2$, that is $p$ a member of A141305. This implies $p\bmod 4=3$, and insures that the largest odd integer $u$ dividing $p-1$ is $(p-1)/2$. It insures the order of $2$ modulo $u$ is $(p-3)/2$ (which is even). Same for $q$. The condition that the Least Common Multiple of the orders is maximal becomes that $\gcd(p-3,q-3)=4$ (which implies $p\ne q$), and said Least Common Multiple then is $(p-3)(q-3)/8$.
With $p,q\in\operatorname{A141305}$ and $\gcd(p-3,q-3)=4$, we have hope for a least period $(p-3)(q-3)/8$; know the true period must divide that, and that $b_1$ is already part of the ultimate cycle; and can check that the least period is per our hopes.
This seems to yield least period $(p-3)(q-3)/8$ for most random $x_0$, perhaps all with $(x_0+1)\bmod p\ge3$ and $(x_0+1)\bmod q\ge3$. I welcome a counterexample.
1 We don't follow the notation in the question, where $x_0$ is an integer, and $x_i$ are bits for $i>0$.
2 If we consider $b_0$ part of the output, or is we do not require $p\bmod4=3$ and same for $q$, BBS is no necessarily purely periodic, only ultimately periodic. We use period for ultimate period, that is the period after the series has entered a cycle.
