Can I just use a subfolder of the live site?

No. It shares the user, the filesystem and usually the database connection, so nothing is really isolated.

How do I keep staging out of Google?

Authentication in front of it. noindex helps, but it only works if the page is crawled and the tag is read.

How do I refresh staging from production?

Copy the database and files, then immediately reset the mail configuration, the third party keys and any admin accounts. Automate that reset so it cannot be forgotten.

When should I move staging to its own server?

When the live site earns money, when tests are heavy, or when more than one person deploys. At that point the shared memory is the risk, not the cost.