What's the optimal way to install and track CiviCRM with Drupal and git?
Drush can support VCS deployments and you can tell drush make to keep the .git directory with "drush make --working-copy your-platform.make". However, unless it's changed recently, drush doesn't have post-install hooks, so it won't handle composer/bower/npm well.

Composer has support for "post-install-cmd", but civicrm itself is not on packagist. I'm not familiar enough with composer to comment further, but from experiences so far, I find Composer more interesting than Drush on many many aspects (not CMS-specific, huge community, great tool).

Personally, and this is not an ideal solution: I build platforms (drupal+contrib+civicrm+extensions) using the tar.gz of each project. Extensions/themes that are actively developed get added as git submodules. All my servers use the same git repo (except for site-specific extensions/themes/modules which are in their own repos) and when I do upgrades, I run a git pull everywhere.

The main down side to this is that I cannot cherry-pick patches from upstream, which was the main issue of your question. I usually apply patches manually.

The main issue I had with running upstream git in production, is that this means I have to run composer/bower/npm/gencode on all production servers whenever there is a new version. That has a too high risk of failing (I manage ~ 20 servers, some with a mix of 4.7-D6, 4.7-D7, 4.6-D7, 4.7-WP).