You're solving the wrong problem. Those four points are symptoms.
The root cause is allowing Snyk configuration to exist at the service level. Stop that.
* Configuration Consistency: Eliminate the config files entirely. Your CI/CD platform should inject the Snyk step with a fixed version and arguments. The repository's only job is to provide a source path. If the scan fails, the pipeline fails. No drift.
* Single Pane of Glass: You won't get one from Snyk. Pull the data via their API into your own data store (BigQuery, Postgres, whatever). Build your own dashboards grouped by CVE *and* your internal service tier. This is a weekend project.
* Remediation Workflow: Never auto-open 50 PRs. That's chaos. Create one platform ticket for a critical, shared CVE. Fix it in one service, validate, then use a batch job to apply the same fix everywhere. Link all PRs to the master ticket.
* Onboarding New Services: This becomes automatic if you solve the first point. New services inherit the platform CI template. If they don't, they don't deploy.
Manage it as a platform contract, not a developer tool.
Trust, but verify