There's definitely some contradiction in the book and a few judgement calls to make, but here's how I'd run it:
1) Yes, generally speaking I would apply a -2 when using the drone with a matrix action since you only get the -2 penalty when performing matrix actions (Running Silent p235). In addition, the only matrix actions this drone/device will ever participate in is the Control Device action (remote control) or when Jumped-in. Autopilots should not be affected by the reduced matrix signature, since they are dog brains housed in the drone, taking real world actions (not matrix actions) based on messages they received. Also, Control Device comes in 2 flavors, cooperative and non-cooperative (Control Device p238). If the drone is yours, the control is always cooperative and you apply the -2 IF(!) a skill test is required (basic actions often do not require tests). On the other hand if you're a decker hacking an enemy drone, then you will always make an electronic warfare test (and you know it's a hacker because the limit to this test is Sleaze) to subvert the drone. In this case I would NOT apply the -2 since the drone is a non-cooperative target and not a participant with its owner. i.e Running silent only hinders the parties using/benefiting from it.
2) I would go with page 269 for device rating. Therefore all of its (two) matrix attributes would equal its pilot rating. Reading it this way is the only way the rules are consistent. That means you have no Sleaze or Attack rating in your drone, but that doesn't mean your limit is zero. The right side of any test opposed test is the defense side and that side (either side really) only ever has a limit in cases where a skill is involved in the defense (limits, p47). That also means that your defense against matrix detection is just your logic score. If you want the benefit of a sleaze rating, the best way to do that (at least till the rigger and/or decker books come out) is to slave the drone to the hacker's cyberdeck. The Master-Slave relationship imparts all the best ratings to the salve for defense tests, including those where Sleaze is part of the defense test (p233). This understanding of the term "defense" was also confirmed by the developers: Here
3) Apart from increasing your logic or buying a cyberdeck, one easy way to help hide is to keep your drones on the public grid so that the person detecting it will either take a -2 dice penalty for being on the public grid or they'll take a -2 penalty for the target being on a different grid (Grids/The Public Grid, pg 233). You could also use a jammer to create noise penalties, but that has other repercussions. Lastly, per pg 269 drones can run cyberprograms as well as autosofts, so that may include things like a Stealth cyberprogram for a +1 Sleaze. Some may disagree on RAW here since the drone does not have a Sleaze rating to increase, so this is a GM call.
4) Your understanding of sharing, programs and noise reduction is correct. This was also confirmed by a developer: Here The device rating of an RCC is the total amount of program space (autosoft and cyberprogram) and noise reduction it can manage on its own (Noise Reduction and Sharing, p.267 and Rigger Cyberprograms p.269) Remember that at any given time a particular drone is either using only the programs loaded on it or it's only using shared the programs off the RCC. It can't do both. Generally that's 2 programs (DR3/2 = 1.5, round up = 2) for the drone (or 3 with VM) or Device rating (-noise reduction +1 for VM) for an RCC. Because of the limited number of autosofts able to be shared, it's generally best to only load the RCC for 1 or 2 types of drone, and use the same weapon on all the drones.
There's some contention on RAW, but I don't think daisy-chaining is allowed in device master-slave relationships due to the following rules: First, it breaks the intended maximum of DRx3 devices benefiting from the master's ratings and second, it contradicts the explicit model for a PAN and the singular wording regarding the network master, "The group consisting of your slaved devices and plus your master...is called a... PAN" (PANs and WANs pg 233). So, I would say it's not within the rules to have a network containing drones with an RCC as their master and a cyberdeck which is also master of the RCC.
Hope that helps.