It should be possible to install and configure Piwik completely from shell scripts, automation programs, etc. This should bypass the web-based installer completely. The automation script would by written by the sysadmin, not by the Piwik team.

Automated installations of Piwik should never modify any configuration file. Updating would be done strictly via automation, as would plugins management, and would never be done via the web.

An automation script written by the sysadmin would be 100% responsible for creating config/config.ini.php. Piwik should never modify it. In fact, if the config file were owned by root and had only 0400 permissions, Piwik should still work. Piwik should provide a shell script (written in php with a !#/usr/bin/env php shebang) that the automation script can call to perform initial installation of the database tables and to update the database tables if they are outdated. That way the automation script can trigger Piwik to setup or update the database.

The automation script should not be required to set up the first website. Instead, after Piwik is installed by automation and the superuser logs in, the superuser can then create as many websites as are needed.

There is already a puppet module for Piwik, so you can add it to a professional configuration management system. I haven’t used this module yet myself, but puppet is really flexible and powerful. Should be possible to extend such a puppet module to handle your tasks.