Since 2016.2, you can use UDL format as well, it's a format as visible in any editor. It can be used for import and for export. XML still supported as well, both ways. So, no issues at all in format.

It's not so easy to say how to deal with multiple packages/repos, with no full picture. But see no issues, if doing it in a right way.

Having code in GitHub, you can use GitHub Actions as well, and it will work too.

I know, about logging in JDBC on the client-side, but not sure how detailed it.

I think you can find if anybody even did such SQL queries, by looking into SQL Cached Queries for the particular table in SMP.

But this will not help to find who did it.

A more reliable way is to look at Journal files. You will need to do a full scan of all journal files. Depends on how many changes you have it may take quite a long time, and you should do it in time until the journal file is purged. If you will find deleting data there, you can get JobID and time when it happened, and by using System Audit, for instance, you would be able to get the exact user.

So, company policy forces to keep all the source code only in Caché? You can install own source control server, even GitHub. It will be completely your own server anywhere you will decide. With no ability to connect from outside if you would need it.

So, yes, I still sure, not a problem at all. 
I have been worked in company with two contours, one is for development with no access to internet, completely isolated. And another network for outside world. And we had to use two PCs, for our work. And we anyway we were able to use source control

InterSystems have changed SuperServer port in a few latest builds, back to 1972. So, just replacing 51773 with 1972, should work.

You can use docker inspect 

docker inspect containers.intersystems.com/intersystems/iris:2020.4.0.524.0

Will outputs something like this

.....
            "ExposedPorts": {
                "1972/tcp": {},
                "2188/tcp": {},
                "52773/tcp": {},
                "53773/tcp": {},
                "54773/tcp": {}
            },
.....
            "Labels": {
                "com.intersystems.adhoc-info": "",
                "com.intersystems.platform-version": "2020.4.0.524.0",
                "com.intersystems.ports.default.arbiter": "2188",
                "com.intersystems.ports.default.license-server": "4002",
                "com.intersystems.ports.default.superserver": "1972",
                "com.intersystems.ports.default.webserver": "52773",
                "com.intersystems.ports.default.xdbc": "53773",
                "com.intersystems.product-name": "IRIS",
                "com.intersystems.product-platform": "dockerubuntux64",
                "com.intersystems.product-timestamp": "Thu Oct 22 2020 13:02:16 EDT",
                "com.intersystems.product-timestamp.iso8601": "2020-10-22T17:02:16Z",
                "maintainer": "InterSystems Worldwide Response Center <support@intersystems.com>",
                "org.opencontainers.image.created": "2020-10-22T19:32:32Z",
                "org.opencontainers.image.documentation": "https://docs.intersystems.com/",
                "org.opencontainers.image.title": "intersystems/iris",
                "org.opencontainers.image.vendor": "InterSystems",
                "org.opencontainers.image.version": "2020.4.0.524.0-0"
            }

I've just left, only interesting lines in your case. Where you can find, which ports are declared as exposed in the image, and labels, which declares available ports in the image.

Access directly to the label

$ docker inspect containers.intersystems.com/intersystems/iris:2020.4.0.524.0 \
  --format '{{ index .Config.Labels "com.intersystems.ports.default.superserver" }}'                                                                        
1972