You should be able to cover the 99% cases by making your ~/.emacs.d a Git repo and cloning it as part of setting up a new machine. This will bring along all your installed packages as well; 'package-list is a customization and thus preserved with your init, and #'package-initialize will install any missing packages it finds when called.
(Speaking of preserved customizations, by default those are written into ~/.emacs.d/init.el. As part of setting up for a version-controlled ~/.emacs.d/, I'd strongly recommend setting 'custom-file to e.g. ~/.emacs.d/custom.el, so that those are stored separately from your init logic proper - it's not a huge issue either way, but customizations are a fertile field for merge conflicts due to the way they're written and stored, and I find this makes those conflicts significantly more comfortable to resolve.)
You could in theory also add init logic to check for the presence of needed external binaries and, if necessary, install them via Homebrew, apt, or some Windows equivalent - I've thought about doing this since I already do have some platform-specific logic in my init, but it hasn't been enough overhead to bother since I rarely need to spin up a new workstation machine.
(Also, of course, ensure that you store any secrets like passwords or other credentials in a separate file, not checked into version control.)
To ensure you reliably have a specific version of Org, you can add the orgmode.org ELPA [1] to your 'package-archives and install a given version from there, rather than relying on whatever comes with a given Emacs build. I do this myself and recommend it to others; Org changes a good deal between versions in my experience, so version pinning helps avoid unexpected behavior that has otherwise been fairly common.
In the same spirit, it can be worth building Emacs from source on a new machine. I also do this, again in order to ensure the behaviors of a specific version to which I've become accustomed; I generally upgrade only when a major new feature or bug fix makes it strongly worthwhile, and then on all my machines at once. (It's a manual process, but not a difficult one. I guess I could automate it, but for something I do a few times a decade, that hasn't seemed worth it so far.)
[1] https://orgmode.org/elpa.html