I am no means an expert here an am still learning but seeing as I have another developer, we needed to to step up our game (Bitbucket). I can answer a few things but I am sure the field will correct me were my approach is not best practice.
My repo only has customized files and compiled class files (addressed below). I do not have xconf files there but have good control on them. I do not have the entire Windchill codebase in source control but rather what would go into wtSafeArea/siteMod, wtCustom, and some added Jar files.
Compilation occurs in Eclipse and is transferred to Dev/Prod via Bitbucket. I have been told I should recompile (build) at those locations and plan to do that since I ran into merge issues already in this area. Still learning here.
We create out feature branches off Development but since we do not have a test server yet, when ready, those feature branches are merged with Development, a Release branch is created off Dev and then merged with Master. I would assume you have some other branches in there based on your pipeline.
As for CPS and Upgrades, I would follow PTC's strategy for applying CPS updates. The only thing you should be concerned with is files that PTC is updating that you might have edited or overwritten. Those are in the CPS release notes and should be in either your ptcOrig or ptcMod folder under wtSafeArea. Obviously, you work up from Dev and test/validate the CPS against your customizations. If there are any conflicts, you'll need bug fixes to address those.
For upgrades, I create a new repo for that version. So much may have changes and I revalidate customizations during the upgrade process. Ok, field, I am ready to be destroyed but more ready to learn and improve. Please enhance or fill in where needed.