A Magento developer who also knows what the server looks like.

Yes. A clearly defined job, such as an extra field in the checkout, gets a fixed price up front. If the scope cannot be predicted, for example with a fault of unknown cause, we work by the hour with an agreed limit. For shops that are developed continuously, we agree a set number of hours per month.

Yes, always. The code stays in the repository of the shop owner, whether that is on GitHub, GitLab or your own Forgejo. We work in separate branches and deliver changes as a pull request. If there is no repository yet and people edit directly on the server, setting one up is our first step.

On a staging environment that matches production: the same versions, the same modules and a recent copy of the database with anonymised customer data. There we go through the change and place test orders. For parts that change often, such as the checkout, we write automated tests that run again after every later change.

Yes. We start by reading what is there: which modules, which changes, how it is deployed. That gives a short list of what is safe to change and what needs attention first. Then we pick up the job. The original agency does not need to be involved.

Yes. Magento has a REST API and a GraphQL API for almost everything the shop can do. We build our own endpoints when the standard ones fall short, for example for an app, an in-store kiosk or a supplier who delivers stock. We arrange access per system with separate keys, so you can revoke one without touching the rest.