Program tokens should work (98% sure), however they may not appear in the token picker: you just have to type them in.Otherwise, indeed use a Change Data Value on a Lead field.
I'm not aware of such a setting. As an alternative, you could do getMultipleLeads to get the Marketo IDs, then call syncLead and pass in the Marketo IDs instead of the email addres...
I would recommend using Workspaces, but only 1 Lead Partition. A Lead can only be in 1 partition, and that causes several challenges in case you have more than 1 partition. Only if...
Your best chance is to wait for the REST API that we'll launch this summer. That may add some new features that make it easier for the end user to install your app to work with Mar...