Git workflow from dev to live when central repo is in local network
Your question is a bit long, and too subjective. There are many ways to do things, and the answers to your questions are subjective. For better answers, post shorter questions that ask about a single factual item. It's hard to answer "what is the best workflow"-style questions on StackExchange; those are better handled on a discussion board.

Trying to pick out your specific questions: it is not necessary to use git to push to live, especially if you always keep a copy of the deployed code on your staging server.  It might be helpful to record the hash tag that you pushed to live somewhere when your script runs.  The main advantage to using git on the live site is that you don't need to do this, as you can use 'git log' to find out what is there.  If you do use git on the live site, be sure that the .git files are not accessible to the webserver.  I prefer to use this setup:

/path/www/mysite.com/.git
/path/www/mysite.com/htdocs/sites/all/default/settings.php


Regarding permissions, see also http://drupal.org/node/990812.  Hopefully I'll have this fixed up and committed soon. It has been languishing for a while; it works, but needs some cleanup in the flags, et.al.