We work a lot with scripts, we don’t use msi and exe, all our snapins are developed as scripts, usually powershell for windows and bash scripting for linux, we use sometimes php, python, perl… called from bash a so on.
Check the potential of the scripting for the 2 first points.
And as alternative to deploy software you can work with snapins+chocolatey
On the third point, we use fog snapins to start/stop services, deploy clients etc…
Currently we are using a reversed vnc server deployed/configured/started/stopped/removed as an unattended snapin, where we have firewalls, As GUI we use a Guacamole Gateway with a vnc-proxy, on the other side where we have not firewalls we are using Dameware and RDP to remote control. The services can be controlled with scripted snapins but the clients/servers/proxyes… must be provided as external services.
I only want to add, that with a deep knowledge of the targets, and with a good knowledge about scripting, and if you add a custom/complete toolset around FOG, you can get a pretty and usefull system admin/management environment.