File and directory management

These are general guidelines.

For Drupal 5.x and later: a new feature/best practice. For a normal (single site) installation, you should put all non-core modules or themes in the sites/all/modules or sites/all/themes folders. For a multi-site installation, put modules or themes in sites/all that you wish to have available for all sites.
Multisite setups allow you to have a modules directory specific to the site in the sites/www.example.com/modules directory. You can still put modules in directories under sites/all/modules if you want them available to all sites. The most specific module or version found is the one that gets used. If you have different versions of image.module stored in both sites/thatsite/modules/image and sites/all/modules/image, then 'thatsite' will use the version found in 'thatsite' directory, while the others will use the other one.
Leave the CHANGELOG.txt file in your root directory as it has the Drupal version information in it. If you manage more than one site, consider putting a version.txt file in the root of your drupal directory with the Drupal version, date and modules you are using. If you only manage a few sites you will probably remember them all, but if you set them up for other people, these reminders can help you if you are asked back to do additional work. Also, it can help the next site admin if you move on.
Rename update.php if you want. There are protections for it in the update script in that you have to be logged in with UID1. As of 4.7 update.php is now required for various module installations and other tasks so if you move/rename it for whatever reason do not forget to put it back to it's original state before module installs/updates.
Remove install.php if you want. This file is only needed during installation.