Yeah I'm not sure how big the STP thing will be, I'm racking my brain trying to remember, I think when VLAN_Inconsistencies are detected on a trunk the VLAN isn't allowed to enter forwarding state or something, but my memory of that is fuzzy at best. I think you can stop that, maybe with something like BPDUFilter on the upstream side of the trunk. In that case you could turn it on to allow Zero Touch to configure and upgrade the switch, then as soon as the switch is configured you could have native vlan matching on both sides and the BPDUFilter could be disabled. I sort of see that as something like a join window, it does make it not true zero touch, but includes a security feature where you have to intervene before a smart install can occure. For me that's a good thing, but for others it might be a pain in the ass. Obviously in either case be careful when playing with anything that can interfear with STP, BPDUFilter is an obvious exclimation point for that warning.
I think you would have trouble with L3 as the defaut config on a blank switch will have all ports in switchport mode and you can't zero touch the switch and also set the port into no switchport mode at the same time. Unless you are refering to having the L3 SVI for VLAN 1 on the director. Obviously that solves all your problems with Smart Install needing vlan 1, but then you need routing back to your TFTP Server and to DHCP, possibly to TACACS and to your management station so in my mind you are basically starting to actively use VLAN 1 for management. In my case this is unacceptable as all our switches have a low numbered VLAN (never 1) as their management interface and that is the only interface I let LMS contact them on. Since LMS does discovery through CDP and CDP always finds the IP of the lowest numbered VLAN on your neighbouring switch, creating VLAN 1 would be very bad for us. It also goes against all the security principals regarding the use and appropriate pruning of vlan 1.
