How do you download Debian securely and make sure 110% that it is an unaltered copy you're getting?
Download Debian installation media. Download the accompanying
SHA256SUMS.sign files. Import the keys from the Debian keyring or a PGP key server and check their fingerprints on the Debian website accessed over HTTPS.
$ gpg --recv-key --keyserver subkeys.pgp.net 6CA7B5A6
# Verify the fingerprints on https://www.debian.org/CD/verify
$ gpg --verify SHA256SUMS.sign SHA256SUMS
# The previous command must print “Good signature from …”
$ sha256sum debian-7.6.0-i386-CD-1.iso
# Compare the value with SHA256SUMS
Does it matter what OS and machine you use to download Debian and could the OS you use compromise the download or after it reaches the computer if the OS is somehow backdoored or compromised itself?
You can download the installation media wherever you want. But for the steps of calculating the SHA-256 checksum, verifying the signature of the
SHA256SUMS file, and comparing the checksum with the content of
SHA256SUMS, you need a trusted machine with trusted tools — a compromised machine could tell you that everything is fine when it isn't.
The guarantee isn't 110% because that's gobbledygook. The guarantee is better than taking advice from a random stranger over the Internet.
Which method is best to download Debian out of the available options ie mirrors, torrent etc?
That doesn't matter for security.
Is GPG a foolproof method for 110% guaranteeing secure and authentic software?
GPG is not foolproof; a fool can misinterpret its output or otherwise use it incorrectly. There's no such thing as 110%. But it's as good as it gets.
Does downloading it over Tor make any difference, for better or for worse and why?
Downloading over Tor can only increase the potential for someone along the chain to modify the downloaded material. However, as indicated above, that doesn't matter, since modifications will be detected. Tor is slower. The only benefit of Tor hides your IP address from the server that you download the files from, and hides the fact that you're downloading Debian from your ISP, if you care about that.