Hi Mark
You pretty much got the gist of what I was meaning, but have only been using moodle about 2 and a half years and git even less but hope this helps as it would give you the structure for progression. But if you find an easier or better way post it here as would be interested also.
What we do at present is we have 3 main branches our DEV, QA and Production we branch of the QA branch for any changes we make at all. We then test the changes locally on our new branch push this to the DEV branch for testing in our clone of the main site and then when happy that code is working it then goes to our QA branch which only gets work which has been signed off sent to it, Then we test it in the QA site and once passed there gets pushed to the production branch.
But for upgrading we have a document for all our core changes and the plugins and mods held separately. However I have been looking at how we could implement this for ourselves and the method I suggested is the one I will be suggesting.
Thanks
Scott