I'm not entirely sure how it all works, or the correct terminology,
The correct terminology is called verification.
I guess it depends on how paranoid one is.
Yes, absolutely. There is no technical solution to these kind of problems. If you are paranoid enough, you wouldn't even trust your computer at all, because it could have been fiddled with before you purchased it.
What would be the minimum reasonable assumptions you would have to make about the environment/process in order to be as confident as possible that a signature and the content it signed is valid and unmodified (short of meeting the developer in person and exchanging key fingerprints)?
You probably want to take a look at the warning page of Tails, which gives a pretty good overview of possible attacks. There is also a section dedicated to the process of verification guiding you through the process step-by-step
Personally, I would argue that it depends pretty much on what you are up to. For most of us, it should be good enough to use secure connection (e.g. SSL/TLS) and compare the downloaded version against some sort of simple hash. This rules out errors during the transmission of any file and really sloppy attempts to get you infected. Signatures are fine, too, but they make only sense if you make sure that the keys being involved match up to your expectation, which sound easy in theory, but turns out to be quite hard in practice.
If you are really not sure as to whether your computer is trustworthy, it would probably be a good idea to get a second opinion in form of another computer. Ideally, this computer would be completely independent of the first one, so it would be hard for an attacker to get both under his control.
(short of meeting the developer in person and exchanging key fingerprints)?
GPG in its normal mode of operation relies on a web of trust, which is quite a good model, but obviously is not perfectly secure. The beauty of it is that you not necessarily need to meet the developer itself, but only need to know someone who knows someone, who knows the developer. You can use this chain of trust to verify the authenticity of any signature.
I'm trying to figure out if there is a way to be 100% sure that a GPG signature is valid.
You won't get this 100% figure in practice. It is always a possibility that someone got hold of the private key. He then could sign whatever the heck he wants to.