I really only have time to give a quick idea for #1. You could accomplish this fairly easily in the following way:

• Make a directory to house all the wrappers
• Put that directory first in the PATH
• Make a generic script, and fill the wrapper directory with symlinks to that script, named the same as the programs you want to wrap
• The wrapper script could work as follows:
• Log @ARGV, etc
• Remove the wrapper directory from the PATH
• exec basename($0), @ARGV

This could easily be circumvented by an aware user (they just have to modify the PATH), but would probably be the easiest to implement.