Apple's 2FA and the notion of "trusted device" and "trusted browser"
A device is trusted if it holds the token string given out by Apple. For browsers this means that the browser has a cookie stored with the string. You're asked when logging in whether or not you want to trust that browser, and that will trigger storing the cookie.

If you clear the cookies, then obviously the browser will not be trusted anymore. Just because you have an habit of clearing your cookies on a regular basis, that does not make Apple's choice "awful" in any way. Technically cookies are probably the most secure way of storing this possible with standards compliant browsers. At least it is a very strong choice.

In order to avoid the browser loosing the trust, simply stop clearing that one specific cookie. There's no point in religiously removing every cooking, if you do not have a purpose for doing that - and especially not if it directly works against you.

In regards to SMS messages: You do not need to receive an SMS message in order to add a new trusted device. You can simply use the 2FA code from one trusted device to add a new trusted device. This is handled automatically by the system.

Regarding the many other questions you have put into your quite broad question: No, updating Xcode won't invalidate the trust. No, having changing IP address won't invalidate the trust.