David,
Just thinking out loud, but for Option #1, you could put the payment collection stuff on a separate page and then use a Page Load action to do a Secure Pause (and other pages could similarly End Secure Pause)
For Option 3, how are you thinking of auto-populated the form? I can't see any way to achieve this at all, never mind without the agent seeing.
If it were me, I would work with the customer to change gateways, or the gateway provider to add an API. I'm amazed they don't (isn't that what 90% of a Payment Gateway is for???) Whatever you end up doing otherwise is likely to be a work-around and could possibly leave the client exposed.
Just my 10 cents.
HTH