What is not safe:

Using only revisor or audit-trail plugins, it's not safe, because if s/he is an unreliable developer, he can easily modify files/DB of those plugins too to hide certain actions.

The real (and the only) secure way

to monitor developer seems the following:

• Use git repository at BitBucket, and add him there.
• Create automatic deployment (with Jenkins) from Bitbucket to Server (so, developer wont have access to server) [I will find the link where this process is described in details].
• Give EDITOR role to developer, so, he can't get into server files (admin-levels can get there, using installing plugins or etc. Instead, you will do major things (installing plugins,etc..) and he can do the rest.
• Setup just action monitoring plugins (audit, revisr, iThemes Security or etc..), and now their logs can't be altered by developer (because he wont have access to server files and DB directly, and will try to avoid nifty things with coding, because his coding changes will be shown in GIT history).

Generally speaking it sounds like you want to be in control of the deployment steps, so pushing changes from development to staging to production; or whatever your exact process is. So you give your developer only access to the development environment for example, but there you want to keep an overview on all the changes made. In my mind there is no need to use plugins for the version control.

Using git diff should be enough to keep track of file changes, it does

Show changes between the working tree and the index or a tree, changes between the index and a tree, changes between two trees, changes between two blob objects, or changes between two files on disk.

Show differences between commits:

git diff old new 
// file names only
git diff old new --name-only

For more options please consult the documentation.

I think this is fairly obvious, and pretty much only a matter of monitoring changes.

Regarding the database, you can use mysqldump to get your database into a file

The mysqldump client utility performs logical backups, producing a set of SQL statements that can be executed to reproduce the original database object definitions and table data. It dumps one or more MySQL databases for backup or transfer to another SQL server.

mysqldump --skip-extended-insert --skip-comments -u username  -p dbname > dump.sql

The command can be specified to exclude certain tables, e.g. you don't care about the wp_posts table in development, or you only include specific tables, e.g. are there changes to wp_users – in short, greater exactness can be achieved.

And then you use diff to

Compare FILES line by line.

diff old.sql new.sql

And check for differences, and see the changes that have been made.

Of course the database backups/dumps can be automated, and e.g. version controlled too, but I'm not getting further into that.

After the checks, if all the changes made are wanted and production-ready, you can implement your deployment strategy.

I feel like this is a reasonably simple process that could be implemented to achieve the control you want.

Aside from that I wanted to outline and illustrate a process not depending on plugins.

VersionPress really suits your requirement - https://versionpress.com/

Any changes in the admin will create a VP file which you can be found here - wp-content/vpdb

If you are also familiar with CLI, then you can easily deploy those VP files from 1 environment to another, e.g. staging to production and vice-versa

You can track what your users are doing, I usually install Stream, Audit Trail is an alternative. You can track changes by user, see if themes or plugins were edited or had settings changed. It may not track the code changes within files as well as you want.

For versioning, you could use Github. It will show what changes have been made to the files. It's going to slow your developer down, but they should probably be familiar with it already.

Also sounds like you could benefit from taking more frequent backups.

Generally, there are two sets of data you want to control with WordPress:

• Files
• Database

So, in theory, you can do it all by hand copying your filesystem and database every day. Now, let's go to the tools you may want to check to make this faster, I will focus on three of them so you can choose from some tools/systems.

Revisr (Hard)

Revisr is a WordPress version control plugin which helps you manage your WordPress files and database from your dashboard. You should know Git before you can fully use this plugin, you can learn more from it following this guide.

VersionPress (Medium)

VersionPress helps you track all changes in WordPress. Unlike Revisr it doesn't require you to make commits, since it does so after every change. For example, when you create a page or install a new plugin, VersionPress tracks it. For every change that it documents, VersionPress gives you an option to either undo an action without affecting other actions or roll back to the stage before you performed the action.

WPEngine backups

This is not a plugin but a hosting company that offers a solid backup/restore solution.

I am WordPress freelancer and I have worked with plenty of different hosting companies, from all I have used, WPEngine has the better backup/restore system, it's pretty straightforward, you can set it up to take backups hourly and you can restore then really fast.

The only downside is the price, if you are in a tight budget you might want to do it yourself, WPEngine won't help you to see what your developer changed but that can be easily done with Stream, the really important thing here is how you can go back to a certain state with no real effort.