I guess you have several options here:
What is now the correct way to maintain that package in it's own repo?
The radical way would be to eventually publish the package in your framework's package repository, and then integrate your package with your favorite automated package management tool, but there might be reasons you are not doing like this.
Do I need to copy my package out of the main app, git init it and push
it to its own repo and composer require it back? If yes, isn't it
complicated to update the package later?
In the meantime, if you can't publish the package to your framework's pakage repository, you could push it to its own repository and update your software manually. It is usefull to decouple your app codebase from a specific versions of your custom package. Loose coopling if often something that is looked for in effective software design, as it avoid breaking changes.
Do I need to add the packages/* folder to the main app's .gitignore?
If you are going to add another package this way, don't add the folder to gitignore, since git only submit deltas over the network.